SCKit worm abuses ScreenConnect to target MSP technician sessions
Original title: SCKit abuses ScreenConnect to deploy remote access and target technician sessions
The worm can ride a hijacked support session onto technician workstations; removing the rogue client does not clear persistence.
Beginning November 11, 2026, ConnectWise reported unauthorized access to cloud-hosted ScreenConnect instances used by managed service providers. Microsoft says attackers used those instances to install extra remote-access clients and deploy the SCKit worm, including RelayTrap, which can deliver a payload to a connecting technician. Persistence uses scheduled tasks and registry Run entries. ConnectWise is still investigating whether an RMM+ extension flaw was the entry point.
Unconfirmed: ConnectWise is still investigating whether RMM+ extension abuse was the campaign’s entry method.
- ConnectWise reported the activity beginning November 11, 2026.
- RMM+ 1.0.31 and 1.0.32 accepted an empty key when none was set.
- ConnectWise says the CVE-2026-84869 fix blocks RelayTrap’s technician spread.
- A batch launcher uses a PowerShell decoder and device-specific key material.
- The campaign’s initial entry method remains under investigation.
Impact: Remote administration, command execution, and further tool deployment
| Product | Affected |
|---|---|
| ConnectWise RMM+ | 1.0.31 and 1.0.32 |
| ConnectWise ScreenConnect | — |
- 1.Investigate technician workstations and downstream managed endpoints for SCKit and RelayTrap.
- 2.Do not stop at removing the unauthorized client; clear persistence and exposed web sessions.
- CVEs
- CVE-2026-84869
- ATT&CK
- T1219 Remote Access SoftwareT1105 Ingress Tool TransferT1059.001 PowerShellT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Organizations
- Microsoft
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | 1% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn007-digitaldownloads.com | he installer configuration lists sc[.]payproofkit[.]com and cdn007-digitaldownloads[.]com as additional ScreenConnect MSI sources. A subsequent cur |
| domain | ns.mo7sen.dev | ets BATPATH to its own location, downloads the decoder from ns[.]mo7sen[.]dev/EadF.php?p=4, and starts it with -Mode full. The decode |
| domain | sc.payproofkit.com | WInstall_…\Installer.ps1. The installer configuration lists sc[.]payproofkit[.]com and cdn007-digitaldownloads[.]com as additional ScreenC |
From the original article
11 min read at microsoft.com
SCKit abuses ScreenConnect to deploy unauthorized remote access and target technicians. Explore the attack chain, mitigations, and Microsoft Defender XDR hunting. The post SCKit abuses ScreenConnect to deploy remote access and target technician sessions appeared first on Microsoft Security Blog.
By Microsoft Security Research, Sagar Patil and Jeremiah Jasmin · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.