SCKit worm infects 288 ScreenConnect endpoints at 48 organizations
Original title: New SCKit Worm Targets ConnectWise ScreenConnect, Infecting 288 Endpoints Across 48 Organizations
AI summary · x-ai/grok-4.7Summaries by Vani AI
Huntress says all 288 hosts were hit within 90 minutes and the console-takeover jump has not succeeded.
Huntress says a worm-like toolkit, SCKit, compromised at least 288 managed endpoints across 48 organizations through abused ConnectWise ScreenConnect panels, starting about 17:47 UTC on November 11, 2026. Attackers used Run Command as SYSTEM to install a rogue client, stop the legitimate service, and set a TrapWatch task meant to steal technician session cookies. ConnectWise disabled five third-party extensions in about 400 partner environments and says it found no ScreenConnect vulnerability. Huntress later tied the activity to RMM+ versions 1.0.31 and 1.0.32, which accepted a blank access key.
Unconfirmed: ConnectWise says initial access is still under investigation and reports no ScreenConnect vulnerability.
Key facts
- About one third of the 288 hosts were hit in the first 10 minutes.
- Named builds include ScreenConnect 26.6.6.9747 and 26.7.6.9783.
- RMM+ 1.0.31 and 1.0.32 accepted a blank access key when none was configured.
- Huntress has not seen the technician-to-panel jump succeed.
- Defenders should not open suspected hosts in an interactive ScreenConnect session.
Security assessment · AI, from the articleExploited in the wild
Impact: Persistent remote access and theft of technician session cookies
| Product | Affected |
|---|---|
| RMM+ | 1.0.31 and 1.0.32 |
| ConnectWise ScreenConnect | 26.6.6.9747 and 26.7.6.9783 |
What to do
- 1.Do not connect to suspected hosts via ScreenConnect; use EDR live response or WinRM.
- 2.Isolate affected hosts and remove the rogue client, TrapWatch task, and RelayTrap artifacts.
- 3.Revoke ScreenConnect and identity sessions, rotate credentials, and leave disabled extensions off.
- ATT&CK
- T1219 Remote Access SoftwareT1053.005 Scheduled TaskT1539 Steal Web Session CookieT1562.001 Disable or Modify ToolsT1059.001 PowerShell
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Malware
- SCKit
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn007-digitaldownloads.com | omain sc.payproofkit[.]com Attacker-controlled panel Domain cdn007-digitaldownloads[.]com C2 domain URL hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Stager |
| domain | gotdns.org | ScreenConnect panel (sc.payproofkit[.]com) Domain newnewnew.gotdns[.]org Attacker relay, resolves to 185.99.255[.]28 Domain soxnew |
| domain | homedns.org | tacker relay, resolves to 185.99.255[.]28 Domain soxnewwork.homedns[.]org Attacker relay (port 81) Domain sc.payproofkit[.]com Atta |
| domain | mo7sen.dev | main cdn007-digitaldownloads[.]com C2 domain URL hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Stager URL hxxps://ns.mo7sen[.]dev/EadF.php? |
| domain | payproofkit.com | staller IP 155.94.150[.]39 Attacker ScreenConnect panel (sc.payproofkit[.]com) Domain newnewnew.gotdns[.]org Attacker relay, resolves t |
| ipv4 | 155.94.150.39 | tacker ScreenConnect server; serves the client installer IP 155.94.150[.]39 Attacker ScreenConnect panel (sc.payproofkit[.]com) Domai |
| ipv4 | 185.99.255.28 | ble is compiled on each host. Type Indicator Description IP 185.99.255[.]28 Attacker ScreenConnect server; serves the client installe |
| sha256 | 0bd84c776dc01f784a617e73fc77b269f847fc4a062ffd489e4692869724bf08 | f9163c61c2f96bb2d2b9fb45 Recover-ExecutionPolicy.cmd SHA256 0bd84c776dc01f784a617e73fc77b269f847fc4a062ffd489e4692869724bf08 Lab-context.json SHA256 454c43d296b1276bde9a4f6ff1da2221cb3 |
| sha256 | 3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4 | d141c41d7680be5cd46c3aeb3febe0f4953b4d LabConfig.ps1 SHA256 3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4 RelayTrap.cs SHA256 d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858 |
| sha256 | 43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95 | 34c534d5d9a42ec362c3dbf0f8d950148d0 Stop-LabTrap.bat SHA256 43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95 Run-Lateral-Full.bat SHA256 50659748723e906c8b3d3c0386bd4cf |
| sha256 | 454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a | 269f847fc4a062ffd489e4692869724bf08 Lab-context.json SHA256 454c43d296b1276bde9a4f6ff1da2221cb35ccdb2fc7991bdd572e45bce12a8a TRAP-PROOF.bat SHA256 5dd3a6ba806ac472663e243cfc1c034c534d5 |
| sha256 | 4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b | 7ebd4dda0d858f372c876ac0a041611698de9a TrapWatch.ps1 SHA256 4a1dd3cd2ea14368afadf7e9dfdd63b104e3981ef8c85bbb6510919b810af04b install.ps1 SHA256 8cb5f48bbe70b5248db7f327f3d1ad6649df5c76 |
| sha256 | 50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61 | 83084625fcc2d3a5985fa1059e2db95 Run-Lateral-Full.bat SHA256 50659748723e906c8b3d3c0386bd4cf692f693a3e23639398c1a14d0c31fed61 runnew.cmd Host desktop-vmc0ifs, send, sc-observation-lab M |
| sha256 | 5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0 | a2221cb35ccdb2fc7991bdd572e45bce12a8a TRAP-PROOF.bat SHA256 5dd3a6ba806ac472663e243cfc1c034c534d5d9a42ec362c3dbf0f8d950148d0 Stop-LabTrap.bat SHA256 43b7a5e56f9e6c7b74e1ce2b7b5af63f383 |
| sha256 | 7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec | ab1e6ac7010af3b9ba1646355eb11 Panel-Lateral-free.ps1 SHA256 7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec Panel-Lateral.ps1 SHA256 b93f10f30ee453d1e1c046fec9d141c41d |
| sha256 | 81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781 | 41cd6a6ccddc645cdda1fa91a9264efe93956 Lite-Alert.ps1 SHA256 81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781 Stage0Loader.ps1 SHA256 c31e6f075cd77e01839aebce32ed35659a9 |
| sha256 | 8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af | dfdd63b104e3981ef8c85bbb6510919b810af04b install.ps1 SHA256 8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af ToolboxRelayUploader.exe SHA256 cf50d73fa8117a758093b1344de |
| sha256 | 94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11 | t.ClientSetup.msi?…&c=Exploited<N> Installer pattern SHA256 94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11 Panel-Lateral-free.ps1 SHA256 7a9aca9fdd4dcc13fe497cabdb13c |
| sha256 | b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d | 1e5d6a529271c8aa495e5ca1c1c80271ec Panel-Lateral.ps1 SHA256 b93f10f30ee453d1e1c046fec9d141c41d7680be5cd46c3aeb3febe0f4953b4d LabConfig.ps1 SHA256 3c7a98f0fdb6235b8076319c74dc1085f7b349 |
| sha256 | c31e6f075cd77e01839aebce32ed35659a9ee962d102aca53040bb5e297410a9 | 29ff28df02c46c6ccdb2b43bde97d19f781 Stage0Loader.ps1 SHA256 c31e6f075cd77e01839aebce32ed35659a9ee962d102aca53040bb5e297410a9 Release-Machine.cmd SHA256 deda7c30d798a19b6699a45fbcba503c |
| sha256 | cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956 | c767d2a7e0711ee147fd92e06af ToolboxRelayUploader.exe SHA256 cf50d73fa8117a758093b1344de41cd6a6ccddc645cdda1fa91a9264efe93956 Lite-Alert.ps1 SHA256 81cc2baa35b798d6084bd078662fa29ff28df |
| sha256 | d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a | 4dc1085f7b349b6d750416dd0cadb07d7972ec4 RelayTrap.cs SHA256 d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a TrapWatch.ps1 SHA256 4a1dd3cd2ea14368afadf7e9dfdd63b104e398 |
| sha256 | deda7c30d798a19b6699a45fbcba503cf778594df9163c61c2f96bb2d2b9fb45 | 9a9ee962d102aca53040bb5e297410a9 Release-Machine.cmd SHA256 deda7c30d798a19b6699a45fbcba503cf778594df9163c61c2f96bb2d2b9fb45 Recover-ExecutionPolicy.cmd SHA256 0bd84c776dc01f784a617e73 |
| url | https://ns.mo7sen.dev/EadF.php?p=4 | ed panel Domain cdn007-digitaldownloads[.]com C2 domain URL hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Stager URL hxxps://ns.mo7sen[.]dev/EadF.php?p=5 Delivers |
| url | https://ns.mo7sen.dev/EadF.php?p=5 | domain URL hxxps://ns.mo7sen[.]dev/EadF.php?p=4 Stager URL hxxps://ns.mo7sen[.]dev/EadF.php?p=5 Delivers SQLite tool for cookie theft Client ID 2588ef5c1 |
From the original article
4 min read at gbhackers.com
A worm-like toolkit called SCKit has compromised at least 288 managed endpoints across 48 organizations through abused ConnectWise ScreenConnect panels. Huntress researchers say the operator pushed rogue clients through cloud-hosted panels, giving the attacker persistent remote access and a trap for stealing technician session cookies. The affected builds include the latest releases, 26.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.