SCKit worm installs rogue ScreenConnect clients via RMM+ flaw
Original title: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
AI summary · x-ai/grok-4.7Summaries by Vani AI
A blank access key in RMM+ 1.0.31 and 1.0.32 let attackers bypass MFA and hit 48 organizations.
Huntress observed operators using cloud-hosted ScreenConnect Run commands to install attacker-controlled clients and the SCKit toolkit on at least 288 endpoints across 48 organizations. The activity matches an authentication flaw in RMM+ 1.0.31 and 1.0.32, which accepted a blank access key and bypassed accounts, roles, and MFA. ConnectWise disabled five related extensions on hosted environments and urged on-premises partners to do the same. Huntress has not seen the planned spread to technician workstations succeed in recovered logs.
Unconfirmed: ConnectWise had not identified the initial access vector or full scope; Huntress links the activity to RMM+.
Key facts
- Commands reached several instances within minutes without matching logins.
- ConnectWise disabled Labtech Plus, RMM Plus, RMM+, and two password-link extensions.
- Those extensions were disabled across more than 400 partner environments.
- Named affected ScreenConnect builds are 26.6.6.9747 and 26.7.6.9783.
- Huntress advises against triaging infected hosts over ScreenConnect.
Security assessment · AI, from the articleExploited in the wild
Impact: Persistent remote access and interception of session cookies
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | 26.6.6.9747 and 26.7.6.9783 |
| RMM+ | 1.0.31 and 1.0.32 |
What to do
- 1.Do not triage infected hosts over ScreenConnect.
- 2.Treat ScreenConnect connections to unfamiliar machines as unsafe.
- 3.Disable RMM+ and the related extensions, including on on-premises instances.
- ATT&CK
- T1219 Remote Access SoftwareT1539 Steal Web Session CookieT1059 Command and Scripting Interpreter
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Malware
- SCKit
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn007-digitaldownloads.com | as the relay (port 81) for rogue client ed630cc2c873b091. cdn007-digitaldownloads[.]com C2 Domain, originally flagged by BlackPoint hxxps://ns. |
| domain | gotdns.org | reenConnect server; serves the client installer newnewnew.gotdns[.]org Attacker relay, resolves to the IP above sc.payproofkit |
| domain | homedns.org | sn't infect the attacker's own infrastructure. soxnewwork.homedns[.]org Attacker relay that resolves to 185.99.255[.]28 and is al |
| domain | mo7sen.dev | set to Run. This dropper is built to connect to hxxps://ns.mo7sen[.]dev/EadF.php and download a loader onto the compromised works |
| domain | payproofkit.com | .gotdns[.]org Attacker relay, resolves to the IP above sc.payproofkit[.]com (155.94.150[.]39,hostname: WIN-FB5CKHMU4E1) Attacker-cont |
| ipv4 | 155.94.150.39 | ker relay, resolves to the IP above sc.payproofkit[.]com (155.94.150[.]39,hostname: WIN-FB5CKHMU4E1) Attacker-controlled ScreenConn |
| ipv4 | 185.99.255.28 | is compiled separately on every host. Item Description 185.99.255[.]28 (hostname: screen) Attacker ScreenConnect server; serves |
| sha256 | 0bd84c776dc01f784a617e73fc77b269f847fc4a062ffd489e4692869724bf08 | ve blockedpowershell.exe itself. Lab-context.json SHA256: 0bd84c776dc01f784a617e73fc77b269f847fc4a062ffd489e4692869724bf08 Config file that travels with the kit. It points the worm a |
| sha256 | 3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4 | client installer URLs SCKit/trapkit/RelayTrap.cs SHA256: 3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4 Source code for the trap. It reuses the machine's real Scre |
| sha256 | 43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95 | kit unless -NoReArm is set. Run-Lateral-Full.bat SHA256: 43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95 It's the dropper: it sets BATPATH to its own path, download |
| sha256 | 454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a | t ID values. SCKit/trapkit/payload/TRAP-PROOF.bat SHA256: 454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a Appends a line to %PUBLIC%\RELAY-TRAP-PROOF.txt and opens i |
| sha256 | 4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b | er its connection slot. SCKit/trapkit/install.ps1 SHA256: 4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b Sets up the trap in C:\ProgramData\RelayTrap, adds the Trap |
| sha256 | 50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61 | it gets handed on to the next machine. runnew.cmd SHA256: 50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61 It downloadsEadF.php with curl.exe to %TEMP%\sckit-loader.p |
| sha256 | 5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0 | s [payload]\Run-Lateral-Full.bat Stop-LabTrap.bat SHA256: 5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0 Does the same as the dropper, but runs the decoder in -Mode |
| sha256 | 7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec | ript but lacking a config file. Panel-Lateral.ps1 SHA256: 7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec The main worm installer script. Steals a technician's SC lo |
| sha256 | 81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781 | alerts deliberately turned off. Stage0Loader.ps1 SHA256: 81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781 It fetches a payload fromEadF.php?p=1 (that only decrypts o |
| sha256 | 8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af | mp folders from running. ToolboxRelayUploader.exe SHA256: 8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af A 32-bit .NET PE file that loads the client's own ScreenCon |
| sha256 | 94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11 | e: Addmin Installer Pattern Panel-Lateral-free.ps1 SHA256:94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11 The main worm installer script but lacking a config file. |
| sha256 | b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d | on the tech has permission to reach LabConfig.ps1 SHA256: b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d A helper library that decrypts cookies, probes SC panels, a |
| sha256 | c31e6f075cd77e01839aebce32ed35659a9ee962d102aca53040bb5e297410a9 | n, and then deletes it. SCKit/Release-Machine.cmd SHA256: c31e6f075cd77e01839aebce32ed35659a9ee962d102aca53040bb5e297410a9 Removes the trap using only built-in Windows tools: it dele |
| sha256 | cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956 | ast to cover tracks. SCKit/trapkit/Lite-Alert.ps1 SHA256: cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956 Running at user logon, it logs ScreenConnect "file run" eve |
| sha256 | d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a | e still looks normal. SCKit/trapkit/TrapWatch.ps1 SHA256: d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a Runs as SYSTEM every 10 seconds; Stops legitimate ScreenCon |
| sha256 | deda7c30d798a19b6699a45fbcba503cf778594df9163c61c2f96bb2d2b9fb45 | client service SCKit/Recover-ExecutionPolicy.cmd SHA256: deda7c30d798a19b6699a45fbcba503cf778594df9163c61c2f96bb2d2b9fb45 Deletes only the SRP/AppLocker rules and stops the AppLocke |
| url | https://ns.mo7sen.dev/EadF.php | the action set to Run. This dropper is built to connect to hxxps://ns.mo7sen[.]dev/EadF.php and download a loader onto the compromised workstation. T |
| url | https://ns.mo7sen.dev/EadF.php?p=4 | wnloads[.]com C2 Domain, originally flagged by BlackPoint hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Stager hxxps://ns.mo7sen[.]dev/EadF.php?p=5 Delivers a |
| url | https://ns.mo7sen.dev/EadF.php?p=5 | BlackPoint hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Stager hxxps://ns.mo7sen[.]dev/EadF.php?p=5 Delivers a copy of the SQLite command-line tool, which th |
From the original article
12 min read at huntress.comAttackers are using cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.