SCKit Malware Abuses ScreenConnect Sessions to Target MSP Technicians
Summary
Blackpoint says SCKit abuses ScreenConnect features and targets technicians’ authenticated sessions to spread across MSP-managed endpoints. Initial access remains unconfirmed, with no evidence of successful technician-workstation propagation or bypass of the CVE-2026-席?
Article Details
- Attack Vectors
- The toolkit uses ScreenConnect's built-in Run Command functionality to download and execute an attacker-controlled MSI installer, which delivers a batch-script dropper.
- The dropper contacts ns.mo7sen[.]dev to retrieve a PowerShell decoder and deploy SCKit components.
- SCKit attempts to hijack authenticated ScreenConnect operator sessions and use existing management permissions to run commands on additional endpoints.
- RelayTrap attempts to replace the legitimate ScreenConnect Guest and send a payload to a connecting technician, potentially compromising the technician's workstation.
- SCKit searches browser data and process memory for authenticated management sessions, including .ASPXAUTH cookies, to support further propagation.
- The article reports that malicious ScreenConnect extensions may be involved in initial access, but says this is unconfirmed. Separately, Huntress identified that RMM+ versions 1.0.31 and 1.0.32 may accept a blank access key when none is configured.
- Defensive Notes
- Patch ScreenConnect clients; the article reports that testing confirmed the existing patch blocks the CVE-2026-84869 exploit payload.
- Protect operator sessions with stronger session validation and additional authentication for high-impact or bulk administrative actions.
- Investigate the management relationship as well as the endpoint, including rogue Access client installations, administrative command history, technician workstations, and browser sessions.
- ConnectWise disabled identified third-party extensions as a precaution and advised on-premises partners to disable them. The article notes that the presence of the extensions alone does not establish compromise.
- Review the RMM+ configuration and extension activity; Huntress reported that versions 1.0.31 and 1.0.32 could accept a blank access key when an administrator had not configured one.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ns[.]mo7sen[.]dev | Reported payload-delivery domain contacted by the SCKit batch dropper to retrieve a PowerShell decoder. |
MITRE ATT&CK
T1059.001 · PowerShellSCKit uses PowerShell scripts, including a decoder retrieved by the batch dropper and a script used to deploy unauthorized ScreenConnect Access clients.T1059.003 · Windows Command ShellThe sckit-run.bat dropper is used to continue deployment after the MSI installer runs.T1059.005 · Visual BasicThe article says earlier attacks exploiting the same CVE delivered a four-stage VBScript payload.T1105 · Ingress Tool TransferThe batch dropper retrieves the PowerShell decoder from ns.mo7sen[.]dev, and the initial installer is described as downloading and running an attacker-controlled MSI.T1219 · Remote Access ToolsThe attackers abuse ScreenConnect's remote-management capabilities, including unauthorized Access clients and existing management sessions, to control endpoints.T1539 · Steal Web Session CookieSCKit searches browser data and process memory for authenticated management-session cookies, including .ASPXAUTH cookies.T1550.004 · Web Session CookieSCKit attempts to reuse recovered authenticated ScreenConnect browser sessions and their cookies to issue commands through existing management permissions.
CVE
People
Nevan BealBlackpoint Cyber APG researcher who contributed to the SCKit findings; he also said the suspected link between initial access and malicious extensions was not confirmed and that patient zero could not be identified without further forensic evidence.Sam DeckerBlackpoint Cyber APG researcher who contributed to the analysis confirming that the exploit targets CVE-2026-84869 and that the existing patch blocks its payload.
Malware
Vendors
Blackpoint CyberBlackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an improper privilege management andConnectWiseThe ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged.HuntressHuntress, in an update, said it has identified a serious authentication flaw in versions 1.0.31 and 1.0.32 of RMM+, one of the five third-party ScreenConnect extensions that has already been blocked by ConnectWise.
Products
RMM+Huntress, in an update, said it has identified a serious authentication flaw in versions 1.0.31 and 1.0.32 of RMM+, one of the five third-party ScreenConnect extensions that has already been blocked by ConnectWise.ScreenConnectThe ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged.