Morocco’s national cybersecurity authority, the General Directorate for Information Systems Security (DGSSI), has issued a high-level alert following the detection of a global cyberattack campaign targeting IT service providers. The warning, released on November 12, 2026, highlights a critical threat involving the exploitation of remote management software, specifically targeting organizations utilizing ConnectWise ScreenConnect.
Understanding the Threat to Managed Service Providers
The DGSSI, which operates under the National Defense Administration, has classified the risk as "critical." The attackers have specifically targeted Managed Service Providers (MSPs), exploiting their elevated access rights to infiltrate multiple client networks simultaneously. By compromising the administration consoles of these service providers, hackers were able to execute malicious commands on at least 288 computers across 48 different organizations within a rapid 90-minute window.
The attackers leveraged the "Run Command" feature within the ScreenConnect software to deploy secondary remote access tools and a malicious payload identified as "SCKit." This malware is designed to establish persistent, unauthorized access to infected systems, effectively bypassing standard security protocols and maintaining control even if the initial point of entry is secured.
DGSSI’s Proactive Stance on National Cybersecurity
This alert is a testament to Morocco’s robust cybersecurity posture, which has been significantly bolstered by the Kingdom's "National Cybersecurity Strategy 2030." Under this strategic framework, the DGSSI acts as the central pillar of national defense, coordinating closely with the national computer emergency response team, maCERT, to monitor and neutralize threats. Morocco continues to prioritize the protection of its critical digital infrastructure, emphasizing the resilience of cloud providers and telecommunications networks.
"The DGSSI remains vigilant in protecting both state institutions and private sector partners from evolving digital threats," the authority noted. Organizations using the affected software are urged to immediately deactivate vulnerable RMM+ extensions, revoke active session keys, and conduct comprehensive audits for suspicious administrative accounts or unauthorized command executions.
Recommended Defensive Measures
In response to the vulnerability, the software vendor ConnectWise has proactively disabled specific extensions in approximately 400 IT environments. However, the DGSSI warns that updates alone may not be sufficient to neutralize the threat if a system has already been compromised. Administrators are advised to:
- Terminate all current administrative login sessions and rotate access credentials.
- Restrict the use of remote command execution features to a strictly limited group of authorized personnel.
- Monitor for the "TrapWatch" process and other indicators of persistent unauthorized access.
- Apply the latest security patches for vulnerabilities CVE-2026-3564 and CVE-2026-84869 for all on-premise installations.
By maintaining a proactive defense, Morocco continues to demonstrate its commitment to international security standards and the protection of its digital sovereignty.
As reported by fokus-afrika.de.
