SCKit Malware Exploits ScreenConnect Vulnerability to Target MSPs

A new worm-like malware toolkit named SCKit has been deployed in recent attacks targeting managed service providers (MSPs) using ScreenConnect. This malware is designed to spread from infected customer devices to MSP technicians’ computers, potentially compromising additional managed networks.

SCKit utilizes a worm-like technique that exploits a previously patched ScreenConnect vulnerability, identified as CVE-2026-84869, to execute malicious code on a technician’s workstation when they connect to an infected device. However, researchers from Huntress and Blackpoint Cyber report that they have not observed successful exploitation of this flaw during the attacks, with Blackpoint confirming that the exploit failed in tests against a patched ScreenConnect client.

The findings follow widespread ScreenConnect attacks where unauthorized access was gained to cloud-hosted environments. Attackers used the platform’s Run Command feature to install rogue ScreenConnect remote-access clients on customer endpoints.

According to an updated report from Huntress, at least 288 endpoints across 48 organizations were compromised, with all affected devices targeted within 90 minutes. Approximately one-third of those systems were affected within the first 10 minutes.

Huntress believes the initial access was through RMM+, a third-party ScreenConnect extension that allows external management tools to interact with ScreenConnect sessions without using the standard technician console. Researchers found that RMM+ versions 1.0.31 and 1.0.32 contained an authentication flaw, enabling attackers to execute commands without proper authentication.

RMM+ uses a shared access key for authentication, but the vulnerable versions allowed the access key to remain blank if an administrator had never configured one. This vulnerability enabled attackers to supply an empty access key and pass the extension’s authentication check, allowing them to issue remote commands.

As part of its response, ConnectWise disabled five potentially related third-party extensions across approximately 400 partner environments, emphasizing that the presence of these extensions does not imply those environments were compromised.

SCKit Spreading Mechanism

In separate analyses, Huntress and Blackpoint Cyber examined SCKit, which consists of 16 scripts and components designed to establish persistent remote access and spread between systems managed through ScreenConnect. Blackpoint’s Adversary Pursuit Group recovered the malware’s loader from attacker-controlled infrastructure and decrypted subsequent stages to obtain the complete loader and a ScreenConnect installer used in the attacks.

The attackers deploy additional ScreenConnect Access clients configured to connect to their servers for persistent remote access, even if the original MSP ScreenConnect session is terminated. SCKit’s unique capability lies in its attempt to turn a legitimate MSP remote support session into an attack against the technician initiating it.

The toolkit includes a component called RelayTrap, which replaces the legitimate ScreenConnect Guest process on an infected endpoint and waits for an MSP technician to establish an interactive connection. Instead of dropping a precompiled executable, the attackers store RelayTrap as a C# source code file named RelayTrap.cs on their infrastructure.

This source code is downloaded to compromised devices, where a PowerShell script compiles it locally into an executable. Another component, TrapWatch, monitors ScreenConnect services and prepares the replacement Guest process to intercept incoming support sessions.

When an MSP technician connects, RelayTrap attempts to send a malicious file back to the technician’s workstation, exploiting CVE-2026-84869, a critical ScreenConnect client-side file-transfer vulnerability patched in version 26.6.5.

Normally, ScreenConnect allows technicians to send files to managed endpoints. However, this vulnerability could allow a malicious Guest to send a file back to the technician and execute it. The recovered source code contains extensive comments explaining its functionality, suggesting it may have been generated using a large language model.

Once running on a technician’s workstation, other SCKit components attempt to steal ScreenConnect authentication cookies from web browsers, enabling attackers to hijack the technician’s authenticated management session without needing their credentials or a new MFA challenge.

The malware then seeks to use the technician’s existing ScreenConnect permissions to enumerate accessible endpoints and distribute malicious commands through legitimate management features, creating a worm-like infection chain. A compromised customer endpoint could infect an MSP technician’s workstation, steal their management session, and use that access to compromise additional endpoints across other customer organizations.

However, Huntress and Blackpoint Cyber have not seen this worm-like behavior succeed during the current campaign. Blackpoint researchers confirmed that their tests against a current ScreenConnect client showed the existing security fix prevented execution of the exploit.

MSPs are advised to disable the affected third-party extensions, update ScreenConnect clients, investigate unauthorized remote-access installations, and review Run Command and Toolbox activity for signs of compromise. Both research teams recommend avoiding interactive ScreenConnect sessions with potentially infected endpoints and instead using separate security tools to investigate systems.

Source: BleepingComputer