Worm-like SCKit malware targets MSPs through ScreenConnect
Huntress links initial access to a blank-key flaw in RMM+ 1.0.31 and 1.0.32, hitting 288 endpoints at 48 organizations.
78
Malware
RelayTrap
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 12, 2026
- Last mentioned1h ago
Timeline
2 articles · newest firstAttackers hijack ScreenConnect panels to push SCKit to 288 devices
Huntress saw all 288 hosts hit in about 90 minutes on November 11; ConnectWise says it found no product flaw.
76
Related CVEs
by mentions- CVE-2026-84869<1%9.9Missing authorization in ScreenConnect client allows unauthorized file execution
Appears with
- ConnectWisevendor · 2
- Huntressorganization · 2
- SCKitmalware · 2
- ScreenConnectproduct · 2
- TrapWatchmalware · 1
- RMM+product · 1
- Blackpoint Cyberorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.