ScreenConnect Attacks: SCKit Malware Targets MSPs
Attackers broke into cloud-hosted ConnectWise ScreenConnect environments and installed rogue remote-access clients on at least 288 endpoints across 48 organizations. Researchers then found SCKit, a toolkit built to spread from customer devices to MSP technicians.
⚡ Why it matters
Remote support tools give a direct path into every customer an MSP manages. In this campaign, all affected devices were hit within 90 minutes.
ScreenConnect is a remote support and access platform used by MSPs and IT teams. Huntress says the campaign hit at least 288 endpoints across 48 organizations, all within 90 minutes and roughly a third in the first 10 minutes.
How the attackers got in
Huntress believes initial access came through RMM+, a third-party extension. Versions 1.0.31 and 1.0.32 let the shared access key stay blank if an admin never set one, so an attacker could send an empty key and run commands with no login or MFA. The attackers then used the Run Command feature to install rogue ScreenConnect clients.
ConnectWise disabled five third-party extensions as a precaution (Labtech Plus, RMM Plus, RMM+ and two Password Link variants) and said there is no evidence of a breach of its infrastructure or a flaw in ScreenConnect itself.
What is SCKit?
SCKit is a worm-like toolkit. Its RelayTrap component tries to jump to the workstation of any technician who connects to a compromised device, using an already patched flaw, CVE-2026-84869 (CVSS 9.9). Blackpoint confirmed the patch blocks this exploit but warned the kit can also hijack logged-in operator sessions.
What to do
- Disable the listed extensions and update the ScreenConnect client.
- Hunt for IoCs such as the domain
ns.mo7sen[.]devand the filessckit-run.batandsckit-decoder.ps1. - Review new admin accounts and unapproved remote-access software on customer and technician machines.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.