Huntress Links SCKit ScreenConnect Worm Activity to Flawed RMM+ Extension

Nov 11, 2026 · Original article ↗

Summary

Huntress observed rogue ScreenConnect clients and SCKit on 288 hosts across 48 organizations. It links the activity to a blank-key authentication flaw in RMM+ versions 1.0.31 and 1.0.32 and details the toolkit’s persistence and intended cookie-relay spread.

Key points

Huntress observed commands sent through cloud-hosted ScreenConnect panels affecting 288 managed endpoints across 48 organizations.
The commands installed attacker-controlled ScreenConnect clients and SCKit; Huntress says the activity appears related to RMM+ versions 1.0.31 and 1.0.32, which could accept a blank access key when none was configured.
SCKit installs RelayTrap persistence, including a scheduled task, and replaces the legitimate ScreenConnect client’s connection behavior.
The toolkit is designed to steal a technician’s ScreenConnect session cookie and use accessible sessions to distribute payloads; Huntress has not observed this spread succeed.
Huntress advises reviewing ScreenConnect Run Command and Toolbox history, avoiding ScreenConnect sessions to suspected hosts, and investigating through out-of-band tools.
Recommended response includes isolating affected hosts, removing rogue clients and persistence, revoking potentially exposed sessions and credentials, and checking for reinfection before restoring service.

Article Details

Attack Vectors: Huntress observed an operator using access to cloud-hosted ScreenConnect panels to run commands on managed endpoints and install attacker-controlled ScreenConnect clients and SCKit.
The activity appeared in logs as commands associated with RMM+. Versions 1.0.31 and 1.0.32 could accept a blank access key if an administrator had not configured one, bypassing ScreenConnect accounts, roles, and MFA.
The installed toolkit downloads and decrypts machine-specific payloads, then installs a RelayTrap component that replaces the legitimate ScreenConnect client's connection slot. The article reports that affected systems were observed reinfecting after isolation was lifted.
SCKit is designed to spread through a technician's workstation by stealing and replaying the .aspxauth session cookie, then uploading a payload to the ScreenConnect Shared Toolbox for execution on other reachable endpoints. Huntress had not observed this spread method succeed in the incidents it reviewed.
The article reports that the toolkit adds Defender exclusions, creates a TrapWatch scheduled task, and adds a RelayTrapLiteAlert Run key. It also describes scripts that add SRP/AppLocker rules.
Defensive Notes: Review ScreenConnect Run Command and Toolbox history for unrecognized commands, tools, or mass activity, and check endpoints for unauthorized second ScreenConnect clients.
Do not investigate a suspected infected host through ScreenConnect. Use EDR live response, WinRM, or another out-of-band CLI tool; investigate a technician workstation from a clean device if the technician connected to a suspected host.
Isolate affected hosts until cleanup is complete. Remove the rogue client and persistence mechanisms, including the TrapWatch task, C:\ProgramData\RelayTrap\, toolkit files under %TEMP%, and the RelayTrapLiteAlert Run key. Verify the legitimate ScreenConnect client before removing anything.
From a clean device, terminate active ScreenConnect web sessions and rotate affected credentials. Revoke potentially exposed browser and identity-provider sessions because the toolkit can steal session tokens.
Audit instance logs to determine affected endpoints and technician workstations. Do not return systems to service until the rogue client and persistence are removed and reinfection checks are complete; continue monitoring panels and endpoints.
ConnectWise disabled RMM+ and several related plugins in hosted environments and urged on-premises partners to disable them. Review whether the affected extension is present and ensure its access key is configured.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cdn007-digitaldownloads[.]com`	C2 domain identified in the article.
DOMAIN	`newnewnew[.]gotdns[.]org`	Attacker relay reported to resolve to the attacker ScreenConnect server.
DOMAIN	`sc[.]payproofkit[.]com`	Attacker-controlled ScreenConnect panel listed in the malware's skip list.
DOMAIN	`soxnewwork[.]homedns[.]org`	Attacker relay reported to resolve to 185.99.255[.]28 and identified in RelayTrap.cs as a relay for a rogue client.
IPV4	`155[.]94[.]150[.]39`	IP address of the attacker-controlled ScreenConnect panel sc.payproofkit[.]com.
IPV4	`185[.]99[.]255[.]28`	Attacker ScreenConnect server that serves the client installer; also identified as the address resolved by attacker relay domains.
SHA256	`0bd84c776dc01f784a617e73fc77b269f847fc4a062ffd489e4692869724bf08`	Hash of Lab-context.json, the SCKit configuration file that points the worm to the attacker panel and contains rogue client IDs.
SHA256	`3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4`	Hash of RelayTrap.cs, the source code for the component that takes the legitimate ScreenConnect client's place on its relay.
SHA256	`43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95`	Hash of Run-Lateral-Full.bat, the dropper designed to download and run the SCKit decoder.
SHA256	`454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a`	Hash of SCKit/trapkit/payload/TRAP-PROOF.bat, a SCKit payload component.
SHA256	`4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b`	Hash of install.ps1, which sets up RelayTrap, the TrapWatch task, and the RelayTrapLiteAlert Run key.
SHA256	`50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61`	Hash of runnew.cmd, which downloads and runs the SCKit loader.
SHA256	`5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0`	Hash of Stop-LabTrap.bat, a SCKit component that runs cleanup and can start a new kit.
SHA256	`7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec`	Hash of Panel-Lateral.ps1, identified as the worm installer script that steals a technician's ScreenConnect login cookie and pushes an upload to reachable sessions.
SHA256	`81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781`	Hash of Stage0Loader.ps1, which fetches, decrypts, and runs a payload from the attacker's EadF.php infrastructure.
SHA256	`8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af`	Hash of ToolboxRelayUploader.exe, which uses a stolen access token to upload a payload to the ScreenConnect Shared Toolbox.
SHA256	`94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11`	Hash of Panel-Lateral-free.ps1, identified as the main worm installer script without a config file.
SHA256	`b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d`	Hash of LabConfig.ps1, a malware helper library that decrypts cookies, probes ScreenConnect panels, and generates rogue client installer URLs.
SHA256	`c31e6f075cd77e01839aebce32ed35659a9ee962d102aca53040bb5e297410a9`	Hash of SCKit/Release-Machine.cmd, a cleanup component that removes the TrapWatch task and RelayTrap executable.
SHA256	`cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956`	Hash of Lite-Alert.ps1, a SCKit component that logs ScreenConnect file-run events and newly installed client services.
SHA256	`d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a`	Hash of TrapWatch.ps1, which runs as SYSTEM, stops legitimate ScreenConnect clients, and takes over their connection slot.
SHA256	`deda7c30d798a19b6699a45fbcba503cf778594df9163c61c2f96bb2d2b9fb45`	Hash of SCKit/Recover-ExecutionPolicy.cmd, a SCKit component that removes SRP/AppLocker rules.
URL	`hxxps[:]//ns[.]mo7sen[.]dev/EadF.php?p=4`	Malware stager URL used to download the decoder.
URL	`hxxps[:]//ns[.]mo7sen[.]dev/EadF.php?p=5`	Malware URL used to deliver SQLite, which the malware uses to read browser cookie databases and steal ScreenConnect session cookies.