Introduction
A new worm-like malware toolkit named SCKit was deployed in recent ScreenConnect attacks targeting managed service providers (MSPs). The malware uses CVE-2026-84869 to execute malicious code on MSP technicians' computers, compromising additional managed networks. Huntress and Blackpoint Cyber researchers have not observed successful exploitation of the flaw during the attacks.
SCKit's Exploitation Technique
SCKit leverages a worm-like technique to exploit CVE-2026-84869, a previously patched ScreenConnect vulnerability. The malware spreads from infected customer devices to MSP technicians' computers, compromising additional managed networks. The attackers use RMM+, a third-party ScreenConnect extension, to gain initial access to the environment.
RMM+ Authentication Flaw
RMM+ versions 1.0.31 and 1.0.32 contain an authentication flaw that allows attackers to execute commands without authenticating to ScreenConnect or completing multifactor authentication. The vulnerable versions allow the access key to remain blank if an administrator has never configured one. When this occurs, an attacker can supply an empty access key and pass the extension's authentication check, allowing them to issue remote commands through the ScreenConnect environment.
SCKit's Persistent Remote Access
SCKit includes a component called RelayTrap, which is designed to replace the legitimate ScreenConnect Guest process running on an infected endpoint and wait for an MSP technician to establish an interactive connection. The attackers store RelayTrap as a C# source code file named RelayTrap.cs on their infrastructure. The source code is then downloaded to compromised devices, where a PowerShell script compiles it locally into an executable. A separate component called TrapWatch monitors ScreenConnect services and prepares the replacement Guest process to intercept incoming support sessions.
Conclusion
SCKit's persistence and ability to turn a legitimate MSP remote support session into an attack against the technician initiating it make it a significant threat to MSPs. The attacks compromised at least 288 endpoints across 48 organizations, with all of the affected devices targeted within 90 minutes. ConnectWise disabled five potentially related third-party extensions across approximately 400 partner environments as part of its response to the attacks. Huntress and Blackpoint Cyber's findings highlight the importance of maintaining up-to-date security measures and monitoring for potential vulnerabilities in remote access and support platforms like ScreenConnect.
Comments