Worm-like SCKit malware targets MSPs through ScreenConnect
Original title: New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks
Huntress links initial access to a blank-key flaw in RMM+ 1.0.31 and 1.0.32, hitting 288 endpoints at 48 organizations.
Huntress and Blackpoint Cyber analyzed SCKit, a 16-part toolkit used after attackers reached cloud ScreenConnect environments and installed rogue remote-access clients. RelayTrap tries to replace the Guest process and, when a technician connects, send a file back using CVE-2026-84869, which ConnectWise patched in 26.6.5. Researchers say that exploit did not succeed against a patched client. Stolen browser cookies could then reuse the technician's management session.
Unconfirmed: Huntress believes the RMM+ blank-key flaw was the initial access; successful use of CVE-2026-84869 was not observed.
- About one-third of the 288 endpoints were affected within the first 10 minutes.
- Every affected device was targeted within 90 minutes, according to Huntress.
- RelayTrap.cs is downloaded and compiled locally into an executable by PowerShell.
- ConnectWise disabled five third-party extensions across about 400 partner environments.
- Extensive comments in RelayTrap.cs led researchers to suspect LLM-generated code.
Impact: Remote commands and persistent access on MSP-managed networks
| Product | Affected | Fixed in |
|---|---|---|
| ConnectWise ScreenConnect | — | 26.6.5 |
| RMM+ | 1.0.31 and 1.0.32 | — |
- 1.Update ScreenConnect clients to version 26.6.5 or newer.
- 2.Set a non-blank access key and stop using RMM+ 1.0.31 and 1.0.32.
- 3.Look for rogue ScreenConnect clients and stolen management cookies on technician PCs.
- CVEs
- CVE-2026-84869
- ATT&CK
- T1210 Exploitation of Remote ServicesT1059.001 PowerShellT1539 Steal Web Session CookieT1021 Remote Services
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Organizations
- HuntressBlackpoint Cyber
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | <1% | KEV | KEV |
From the original article
4 min read at bleepingcomputer.com
A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.