---
id: "CMP-202611-kbz5yt"
page: "https://infrastack.ai/live/CMP-202611-kbz5yt"
kind: "campaign"
aliases: []
title: "Fake crypto-exchange-named computers (KUCOIN-SRV, LAPTOP-BINANCE) appear on 100+ self-hosted ScreenConnect servers, possibly as bait for technicians (Huntress)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "ScreenConnect", "fixed": [], "vendor": "ConnectWise"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-14T00:00:43+00:00"
updated_at: "2026-11-14T00:02:10+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-14T00:00:43+00:00"}]
exploit_sources: []
---

# Fake crypto-exchange-named computers (KUCOIN-SRV, LAPTOP-BINANCE) appear on 100+ self-hosted ScreenConnect servers, possibly as bait for technicians (Huntress)

Link for people: https://infrastack.ai/live/CMP-202611-kbz5yt (this .md is for agents)

Since 3 Nov 2026 someone has registered 2,400+ fake unattended Access guest sessions on at least 118 self-hosted ScreenConnect servers at 109 MSPs and organizations (Huntress, as of 13 Nov). A scripted emulator posing as a Windows ScreenConnect client uses the relay address from the server's publicly downloadable Access installer. The fake machines have crypto-exchange names and trading-desktop thumbnails, and they reconnect so they always look online. Huntress has seen no malicious activity from them yet: no files pushed and no commands run. Its leading theory is bait: when a technician on an unpatched client joins, the guest could exploit CVE-2026-84869 (a malicious guest makes the technician's client run a file). Capturing what technicians type is also possible. Huntress finds no overlap with the SCKit worm. Who is behind it is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :ScreenConnect affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the fake Access guest sessions were registered on self-hosted ScreenConnect servers using the relay address from a publicly downloadable installer, but it does not say how the attacker got into the affected organisations, and Huntress has seen no files pushed or commands run so far, with the bait theory still unconfirmed.

How it reached others: it stayed inside (none).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#unknown

## How to check

In the ScreenConnect Access session list (App_Data\Session.db), look for guest names that pair an exchange or crypto word with a role word (KUCOIN-SRV, SRV-BINANCE, LAPTOP-BINANCE, BACKUP-PROBIT, WORKSTATION-COINEX, DASH-BITMEX), empty company/site fields, guest version 25.3.4.9288, ClientType 1 (Windows) with an empty guest public key, and crypto-site preview thumbnails. Check server logs for many new Access guests from one IP, especially 74.208.158[.]106 (IONOS) and 197.47.160[.]252. Related host: 87.106.111[.]220. SSH host key fingerprint of 74.208.158.106: SHA256:kt6iiIS3kcQ3NsUSVfk7gJoGMSSUqMdXqsmjb+/cSHg. Bait thumbnail SHA256: 008839ef2a2d54e9efa47013bb23c773d3a152f351e9dfd3b2f4dd27086121df, 45136a9ab47015c4334b881df9daf824a72347daae0b5730ce3bd7d42b204bf2, e73020645e7a11a90865d93bd7f3d797585f49ef72b1ac7354392a2da7fbd91f, c15b008b0296b1bc9e0f979e6f25b780e3e89edabb344c7ee8c284a1a140f0d7, b55ce5130cd2623017cca29318341f6b4656e3a1dc5ab82ce704e912d0d17535, bea82efc82672225cf29eb869972670754f15941bc61b9e5801ffd41c5c39e5f. Use the session history to see whether a technician joined one and whether files, commands or 'send text' moved. On technician workstations, look for ScreenConnect.WindowsClient.exe starting cmd.exe, powershell.exe, wscript.exe or msiexec.exe with a file under Documents\*\Temp\, and check the ScreenConnect Temp and Startup folders.

## Fix

Update every technician's ScreenConnect host client, and affected Access agents, to 26.6.5 or later. Until then, follow ConnectWise's advice to remove the TransferFiles permission from roles and session groups. Do not join sessions you cannot tie to a customer. Copy Session.db and its WAL file before you delete the fakes. Keep Access installer links private and rebuild any installer that leaked. Restrict installer and web access where you can. Block 74.208.158.106 and 197.47.160.252, though the operator may move. If a technician typed into a fake session, treat what they typed as exposed and change those credentials.

## Timeline

- 2026-11-14T00:00:43+00:00 analyst

## Documents

- [describes] Huntress: Attackers use Crypto Exchange Names to Disguise Unauthorized Sessions on 100+ ScreenConnect Servers https://www.huntress.com/blog/fake-crypto-exchange-sessions-screenconnect

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_