cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

SCKit Malware Attempts Worm-Like Spread Through MSP ScreenConnect Sessions

· Original article ↗

Summary

Researchers describe SCKit’s attempted spread from infected customer devices to MSP technicians through ScreenConnect. They found no evidence its worm-like exploit succeeded; the campaign’s initial access may have involved a flaw in RMM+.

Key points

  • Huntress reported at least 288 endpoints across 48 organizations were compromised in the ScreenConnect attacks; the devices were targeted within 90 minutes.
  • Huntress believes attackers may have gained initial access through RMM+ versions 1.0.31 and 1.0.32, which could accept a blank shared access key and allow unauthenticated remote commands.
  • SCKit includes RelayTrap, which attempts to send a malicious file from an infected customer endpoint to an MSP technician’s workstation by exploiting CVE-2026-84869.
  • Researchers said the patched ScreenConnect client blocked the attempted exploit; they found no evidence that SCKit’s worm-like spread succeeded in the campaign.
  • Other SCKit components attempt to steal ScreenConnect authentication cookies and use a technician’s existing permissions to reach additional endpoints.
  • ConnectWise disabled five potentially related third-party extensions across about 400 partner environments, noting that their presence does not mean an environment was compromised.
  • Researchers recommend disabling affected extensions, updating ScreenConnect clients, investigating unauthorized remote-access installations, and reviewing Run Command and Toolbox activity.

Article Details

Attack Vectors
  • Attackers reportedly used RMM+ versions 1.0.31 and 1.0.32, whose authentication flaw could allow commands when the shared access key was left blank.
  • Attackers used ScreenConnect's Run Command feature to install rogue remote-access clients on customer endpoints.
  • SCKit includes RelayTrap, which attempts to exploit CVE-2026-84869 by sending a file from an infected endpoint to a connecting technician; researchers found no evidence that the exploit succeeded in the campaign.
  • A PowerShell script compiles the downloaded RelayTrap.cs source code locally on compromised devices.
  • SCKit attempts to steal browser-held ScreenConnect authentication cookies and use the technician's existing session to enumerate endpoints and distribute commands through ScreenConnect features.
Defensive Notes
  • Disable the affected third-party extensions and update ScreenConnect clients; ConnectWise patched CVE-2026-84869 in version 26.6.5.
  • Investigate unauthorized remote-access installations and review Run Command and Shared Toolbox activity for signs of compromise.
  • Avoid interactive ScreenConnect sessions with potentially infected endpoints; use separate security tools to investigate them.

MITRE ATT&CK

T1059.001 · PowerShellA PowerShell script downloads and compiles RelayTrap.cs locally on compromised devices.T1072 · Software Deployment ToolsSCKit attempts to use a technician's ScreenConnect permissions and management features, including Shared Toolbox, to distribute commands to accessible endpoints.T1105 · Ingress Tool TransferRelayTrap.cs is downloaded from attacker infrastructure to compromised devices before local compilation.T1219 · Remote Access ToolsAttackers install additional ScreenConnect Access clients configured to connect to servers under their control for persistent remote access.T1539 · Steal Web Session CookieSCKit components attempt to steal ScreenConnect authentication cookies from web browsers to hijack a technician's session.

CVE

CVE-2026-84869ConnectWise · ScreenConnecttoolkit uses a worm-like technique that exploits a previously patched ScreenConnect vulnerability, CVE-2026-84869, to execute malicious code on a technician's workstation when they connect to an infected device.

People

Nevan BealBlackpoint Cyber researcher who, with Sam Decker, reported reproducing SCKit's attempted exploit against a current ScreenConnect client and finding that the security fix prevented execution.Sam DeckerBlackpoint Cyber researcher who, with Nevan Beal, reported reproducing SCKit's attempted exploit against a current ScreenConnect client and finding that the security fix prevented execution.

Malware

sckitNew worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks

Vendors

Blackpoint CyberHowever, researchers at Huntress and Blackpoint Cyber say they have not observed successful exploitation of this flaw during the attacks, with Blackpoint confirming that the exploit failed in testing against a patchedConnectWiseAs part of its response, ConnectWise disabled five potentially related third-party extensions across approximately 400 partner environments.HuntressHowever, researchers at Huntress and Blackpoint Cyber say they have not observed successful exploitation of this flaw during the attacks, with Blackpoint confirming that the exploit failed in testing against a patched

Products

RMM+Huntress also believes the initial access was through RMM+, a third-party ScreenConnect extension that lets external management tools interact with ScreenConnect sessions without using the standard technician console.ScreenConnectNew worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks

Industries

Managed service providersmalware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and

Related Articles