Attackers hijack ScreenConnect panels to push SCKit to 288 devices
Original title: Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations
Huntress saw all 288 hosts hit in about 90 minutes on November 11; ConnectWise says it found no product flaw.
Attackers took over cloud-hosted ConnectWise ScreenConnect panels and used the Run command to install a custom toolkit, SCKit, on at least 288 managed devices at 48 organizations. Huntress first saw the activity on November 11, 2026, with commands running as SYSTEM that dropped a rogue installer and a second ScreenConnect client. ConnectWise says it found no intrusion of its own systems and no flaw in ScreenConnect, and it disabled five third-party extensions in about 400 partner environments. The initial access path and full scope remain unknown.
Unconfirmed: ConnectWise has not identified initial access or full scope and says there is no ScreenConnect flaw, while reports say those versions are affected.
- About one third of the 288 hosts were hit in the first 10 minutes.
- SCKit has 16 files and unlocks a per-machine payload after sending a Windows ID.
- A TrapWatch task replaces the real client with the attacker’s copy.
- Huntress has not seen the technician-session cookie-spread succeed.
- On-prem partners must disable the named extensions themselves.
Impact: SYSTEM commands and a rogue ScreenConnect client on managed PCs
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | 26.6.6.9747 and 26.7.6.9783 (reports; vendor disputes a flaw) |
- 1.Do not connect to a suspect machine through ScreenConnect; use EDR live response or WinRM.
- 2.Isolate hosts and remove the rogue client, TrapWatch task, RelayTrap folder, and RelayTrapLiteAlert Run key.
- 3.Revoke web sessions, rotate credentials from a clean device, and review Run Command and Toolbox history.
- ATT&CK
- T1059 Command and Scripting InterpreterT1053.005 Scheduled TaskT1562.001 Disable or Modify ToolsT1539 Steal Web Session Cookie
- Vendors
- ConnectWise
- Products
- ScreenConnect
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn007-digitaldownloads.com | domains newnewnew.gotdns[.]org , soxnewwork.homedns[.]org , cdn007-digitaldownloads[.]com , and ns.mo7sen[.]dev . They also include the IP address |
| domain | gotdns.org | om a clean device. Indicators include the domains newnewnew.gotdns[.]org , soxnewwork.homedns[.]org , cdn007-digitaldownloads[.]co |
| domain | homedns.org | ors include the domains newnewnew.gotdns[.]org , soxnewwork.homedns[.]org , cdn007-digitaldownloads[.]com , and ns.mo7sen[.]dev . T |
| domain | mo7sen.dev | work.homedns[.]org , cdn007-digitaldownloads[.]com , and ns.mo7sen[.]dev . They also include the IP address 185.99.255[.]28 and th |
| ipv4 | 185.99.255.28 | om , and ns.mo7sen[.]dev . They also include the IP address 185.99.255[.]28 and the participant name Addmin . ConnectWise says the in |
From the original article
3 min read at cybersecuritynews.com
Attackers have taken over cloud-hosted ScreenConnect panels and used them to push a custom toolkit called SCKit to at least 288 managed devices across 48 organizations. Security firm Huntress first saw the activity on November 11, 2026, and says all 288 hosts were hit within about 90 minutes. Huntress reports that about one third of […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.