Microsoft Details SCKit Malware Abuse of ScreenConnect to Target MSP Technicians

Nov 13, 2026 · Original article ↗

Summary

Microsoft confirms ScreenConnect abuse to deploy SCKit on managed endpoints. The toolkit installs unauthorized remote-access clients, persists, and targets technicians’ sessions; the reported initial-access route remains under investigation.

Key points

Microsoft confirmed reported activity involving unauthorized access to cloud-hosted ScreenConnect instances and observed abuse to install remote-access clients and deploy SCKit.
SCKit uses ScreenConnect commands to download an additional client, then retrieves and decrypts toolkit components using device-specific key material.
RelayTrap persists through scheduled tasks and registry Run entries and is designed to deliver a launcher to a technician connecting from a vulnerable ScreenConnect host client.
The toolkit targets Chrome, Edge, Opera, and Opera GX authentication cookies, using browser databases and process-memory scanning; its console-distribution component can upload and queue payloads.
ConnectWise says ScreenConnect client 26.6.5 and later blocks the attempted endpoint-to-technician transfer technique; the fix for CVE-2026-84869 was released September 8, 2026.
Microsoft recommends investigating technician workstations and downstream endpoints, revoking exposed sessions, removing persistence and unauthorized clients, and verifying approved services before restoring connectivity.
Microsoft provides Defender XDR hunting queries, detection names, hashes, and campaign infrastructure indicators, including ns[.]mo7sen[.]dev and sc[.]payproofkit[.]com.

Article Details

Attack Vectors: Threat actors abused ScreenConnect access to issue remote commands on managed endpoints and install an additional client connected to attacker-controlled infrastructure.
The installed client used curl.exe to download an MSI over HTTP; further commands retrieved a PowerShell decoder and encrypted toolkit components.
SCKit establishes persistence using a scheduled task and a machine-wide Run entry. RelayTrap is designed to deliver the toolkit’s launcher to a technician workstation when a technician connects; the article describes this as a propagation design, not a confirmed infection sequence.
SCKit searches technician browser profiles and process memory for .ASPXAUTH cookies, then is designed to use authentication and access tokens to distribute payloads through the ScreenConnect management console.
ConnectWise reported an authentication flaw in RMM+ versions 1.0.31 and 1.0.32 when no access key was configured. ConnectWise is investigating extension abuse as an entry route, and the campaign’s entry method remains under investigation.
Defensive Notes: Disable the identified ScreenConnect extensions and review their installation, configuration, and administrative-access history.
Update technician clients to ScreenConnect client 26.6.5 or later; the article says this blocks the attempted endpoint-to-technician transfer technique. Verify client versions separately from the cloud console.
Investigate and isolate affected endpoints and connecting technician workstations using an approved out-of-band response method rather than ScreenConnect.
Revoke affected ScreenConnect and identity-provider sessions from a clean device, rotate exposed credentials, and review account permissions.
Review extension, authentication, Run Command, Toolbox, process, file, task, and registry records. Remove unauthorized clients, malicious tasks and Run values, trap files, and unauthorized antivirus exclusions.
Verify approved ScreenConnect instances and relay destinations, effective antivirus settings, and that persistence has not been recreated before restoring connectivity. Keep Defender Antivirus, cloud-delivered protection, and tamper protection enabled.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cdn007-digitaldownloads[.]com`	Campaign infrastructure configured as an additional ScreenConnect MSI source.
DOMAIN	`newnewnew[.]gotdns[.]org`	Domain associated with an unauthorized ScreenConnect relay.
DOMAIN	`ns[.]mo7sen[.]dev`	Campaign domain used to retrieve the decoder, toolkit bundle, scripts, and utility.
DOMAIN	`sc[.]payproofkit[.]com`	Attacker-controlled ScreenConnect panel and installer source; the article also identifies it as a source for an additional client installer.
DOMAIN	`soxnewwork[.]homedns[.]org`	Domain associated with an unauthorized ScreenConnect relay.
IPV4	`155[.]94[.]150[.]39`	IP address associated with the unauthorized ScreenConnect panel.
IPV4	`185[.]99[.]255[.]28`	Unauthorized ScreenConnect server and installer source identified in the campaign.
SHA256	`3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4`	Hash of the RelayTrap.cs source used to build the technician-targeting component.
SHA256	`43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95`	Hash of Run-Lateral-Full.bat, a launcher included among the toolkit artifacts.
SHA256	`454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a`	Hash of TRAP-PROOF.bat, identified in the article as a proof artifact supporting investigation.
SHA256	`4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b`	Hash of the toolkit's trapkit\install.ps1 installer.
SHA256	`50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61`	Hash of runnew.cmd, a toolkit-related launcher artifact.
SHA256	`5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0`	Hash of Stop-LabTrap.bat, a cleanup-mode launcher associated with the toolkit.
SHA256	`61a672a13f03a9e81f573535ee92b1ed6cb7e848a33a06048865312d4e185ae2`	Hash of the sc.msi installer package used to install an unauthorized ScreenConnect client.
SHA256	`7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec`	Hash of the Panel-Lateral.ps1 campaign component.
SHA256	`81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781`	Hash of Stage0Loader.ps1, a SCKit loader artifact.
SHA256	`8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af`	Hash of ToolboxRelayUploader.exe, used by the toolkit for console-based payload distribution.
SHA256	`8e6912deed82e80bb6bd66f73509d024b1f78b993515366d8317e69a97cff4f4`	Hash of the staged SCKit toolkit ZIP.
SHA256	`94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11`	Hash of the Panel-Lateral-free.ps1 campaign component.
SHA256	`b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d`	Hash of the LabConfig.ps1 helper included in the toolkit artifacts.
SHA256	`cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956`	Hash of Lite-Alert.ps1, a script launched by the RelayTrapLiteAlert Run entry.
SHA256	`d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a`	Hash of TrapWatch.ps1, the watcher component associated with RelayTrap.