Huntress tracks SCKit worm-like toolkit designed to spread to MSP technician workstations via ScreenConnect

Huntress observed at least 288 endpoints across 48 organizations compromised by SCKit on November 11, 2026. Huntress said the activity began around 17:47 UTC, and ConnectWise posted an advisory at 22:45 UTC the same day. The activity hit all targets within 90 minutes, with roughly one-third compromised in the first 10 minutes.

SCKit is a package of 16 scripts and components, including PowerShell, batch, and command-line files, designed to establish persistent access and spread through ScreenConnect-managed systems. A component called RelayTrap replaces the legitimate ScreenConnect Guest process on an infected endpoint and waits for a technician to start an interactive connection. When a technician connects, RelayTrap tries to send a malicious file from a compromised customer endpoint back to a technician workstation, reversing the usual file-transfer direction.

The toolkit’s other components try to grab ScreenConnect authentication cookies from web browsers on a technician’s workstation, potentially hijacking sessions without credentials or another multifactor authentication challenge. After infecting a technician’s workstation, SCKit searches local browser data and process memory to recover.ASPXAUTH authentication cookies for session hijacking. The toolkit then leverages the technician’s current ScreenConnect rights to list reachable endpoints and send harmful commands through legitimate features including the Shared Toolbox. Huntress said the attempt to take over the console did not succeed in any recovered host log it reviewed.

Huntress launched a Rapid Response in September 2026 after spotting worm-like activity creating unauthorized ScreenConnect clients in several customer environments. Huntress believes initial access involved RMM+, a third-party ScreenConnect extension that lets external tools manage sessions without the standard technician console. RMM+ versions 1.0.31 and 1.0.32 contained an authentication flaw where an unconfigured access key defaulted to blank, allowing an empty key to pass authentication and issue remote commands without multifactor authentication. ConnectWise said the presence of these extensions does not establish compromise and that the initial access method remained unconfirmed, while Blackpoint said evidence is insufficient to confirm, and ConnectWise’s early assessment points to a threat actor possibly abusing independent third-party extensions set up in partner environments.

ConnectWise disabled five third-party extensions across approximately 400 partner environments on November 11, 2026, as a precaution: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. When ConnectWise published its advisory that evening, it had not identified the initial access vector or the full scope of the attack. Blackpoint Cyber said it found no technical link between the disabled third-party extensions and SCKit.

The attack first checks for an existing ScreenConnect installation, then downloads an attacker-controlled MSI installer named sc.msi, which delivers a batch script dropper named sckit-run.bat. The initial command downloaded the installer to C:\Windows\TEMP\sc.msi and wrote a base64-encoded dropper to C:\Windows\Temp\sckit-run.bat. The dropper contacts ns.mo7sen[.]dev to fetch a PowerShell decoder named sckit-decoder.ps1, then downloads a machine-specific copy of the SCKit toolkit. SCKit components include sckit-loader.ps1, which decrypts and launches a machine-specific script, and k[32 Hex].ps1 then extracts the toolkit to C:\ProgramData\RelayTrap.

TrapWatch.ps1 runs as SYSTEM, compiles RelayTrap.cs into a host-specific executable at C:\ProgramData\RelayTrap\trapbins\<client id>\RelayTrap.exe, creates the TrapWatch scheduled task, stops the legitimate ScreenConnect client, and sets it to manual start. SCKit components add Microsoft Defender exclusions, AppLocker or software restriction policy rules, and install a second attacker-controlled ScreenConnect client, creating persistence through C:\ProgramData\RelayTrap\ and the RelayTrapLiteAlert Run key. The toolkit includes SilentForceInstall-WithUninstall.ps1, used to establish persistence by deploying two unauthorized ScreenConnect Access clients, and attackers deployed more ScreenConnect Access clients to attacker-controlled servers for persistent access after the original support session ended. Attackers ran commands as SYSTEM on many endpoints at once using ScreenConnect’s legitimate Run Command feature.

After a technician connects to a compromised endpoint, the malware waits 2.5 seconds before retrieving a dropper named Run-Lateral-Full.bat from the infected machine. That dropper connects to hxxps://ns.mo7sen[.]dev/EadF.php to download a loader that gathers the workstation’s unique ID and receives an encrypted kit from attacker infrastructure. Panel-Lateral.ps1, assisted by LabConfig.ps1, steals the.aspxauth session cookie from the technician’s workstation and attempts to replay it against the ScreenConnect panel to enumerate other accessible sessions. ToolboxRelayUploader.exe uploads a payload named WithUninstall.ps1 to the panel’s Shared Toolbox and commands every reachable session to run it; the payload runs as SYSTEM and the toolbox item is deleted roughly 60 seconds after the broadcast.

SCKit includes a guest-to-host file-transfer technique tied to CVE-2026-84869, a ScreenConnect client-side flaw patched by ConnectWise in version 26.6.5. CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on September 11, 2026, requiring federal agencies to apply fixes by September 14, 2026. Blackpoint said patching blocks the known exploit but does not remove risks from an already compromised ScreenConnect operator session. No evidence shows that an unpatched ScreenConnect client served as the initial entry point for these attacks.

Once an attacker holds a valid ScreenConnect session, RelayTrap’s technician-workstation infection chain abuses trusted functionality and does not require a software vulnerability, and the research names affected ScreenConnect builds 26.6.6.9747 and 26.7.6.9783.

CVE-2026-84869 carries a CVSS score of 9.9 and is a missing-authorization and improper-privilege-management vulnerability. It was previously exploited to distribute a four-stage Visual Basic Script payload and ultimately serve an XMRig cryptocurrency miner. Huntress said the campaign affected at least six managed service providers among the 48 organizations that had 288 compromised hosts.

Huntress said the recovered RelayTrap source code contains extensive comments and workarounds giving it the appearance that a large language model generated it, and Huntress said it appears LLM-generated. Blackpoint researchers tested the exploit on a current ScreenConnect client and confirmed the existing security fix blocked the payload; they said the client queued the guest-side transfer but did not request or execute it. Huntress and Blackpoint Cyber have not observed successful worm-like propagation to a technician workstation or bypass of the vendor patch for CVE-2026-84869 during the current campaign.

ConnectWise advised on-premises partners to disable the identified extensions immediately and to review precautionary guidance in the ConnectWise Trust Center. Huntress and ConnectWise both released indicators of compromise for the campaign and urge organizations to remove the extensions from on-premises ScreenConnect deployments. ConnectWise said the disabled extensions expose an API able to run remote commands, and a partner-set passphrase protects that API during setup. ConnectWise stated it knows of malicious-activity reports affecting some ScreenConnect partners and is investigating them actively.

Huntress recommends that MSPs skip interactive ScreenConnect sessions with possibly compromised endpoints and instead rely on separate security tools such as EDR live response or WinRM for investigation. Defenders should review Run Command and Toolbox history, end active ScreenConnect web sessions, change credentials, and revoke exposed browser and identity-provider sessions. Huntress advises not putting a host back into service until the rogue client and its persistence are removed, the system is checked for reinfection, and panels and endpoints keep being monitored. Huntress recommends using its SIEM with ScreenConnect connected as a data source to hunt for suspicious administrator activity at scale.

Defenders should look for and remove runnew.cmd, sqlite3.exe, and the RelayTrapLiteAlert value under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, the rogue client service, and TrapWatch task. Huntress observed affected systems reinfecting shortly after defenders lifted isolation, so isolation alone does not remove persistence. Huntress said it did not observe all SCKit functionality during incidents; payload analysis revealed some capabilities. File hashes are weak indicators because scripts are rebuilt per host and TrapWatch compiles the trap executable on each machine.