MalwarePublished 13 Nov 2026

SCKit abuses ScreenConnect to deploy remote access and target technician sessions

Source Microsoft Security Blog

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2026-84869

Description

Starting November 11, 2026, threat actors exploited unauthorized access to ConnectWise ScreenConnect instances used by managed service providers to deploy a malicious worm called SCKit. This worm installs unauthorized remote-access clients on customer endpoints and targets IT technician workstations by hijacking authenticated ScreenConnect sessions. SCKit establishes persistence on infected devices and uses a component named RelayTrap to deliver malicious payloads to connecting technicians, enabling lateral movement and further compromise. The attack leverages a reported authentication flaw in certain RMM+ extension versions and abuses legitimate ScreenConnect functionality. Removing unauthorized clients alone does not eliminate persistence or session exposure. Mitigation involves investigating technician workstations and downstream endpoints and applying fixes for known vulnerabilities.

Impact

Threat actors gain unauthorized remote access to managed service provider ScreenConnect instances and customer endpoints, enabling them to execute commands, deploy additional malicious tools, and maintain persistent control. The worm targets both customer endpoints and IT technician workstations, facilitating lateral movement within managed environments. This compromises the integrity and confidentiality of managed devices and support infrastructure. The attack bypasses normal authentication by exploiting an extension authentication flaw and abuses legitimate remote-support functionality. Persistence mechanisms prevent simple removal of unauthorized clients from fully remediating the infection. The compromise allows attackers to administer endpoints remotely and deploy further payloads without detection.

Defensive guidance

ConnectWise has released a fix for CVE-2026-84869 that blocks the client-side propagation of the SCKit toolkit via RelayTrap. Organizations should apply this official fix promptly. Defenders should investigate technician workstations and downstream managed endpoints for signs of compromise, as removing unauthorized clients alone does not remove persistence or invalidate exposed web sessions. Monitoring and responding to indicators of compromise and using Microsoft Defender XDR advanced hunting queries can help identify and disrupt this activity. Additionally, ensure that RMM+ extensions are configured with strong access keys to prevent unauthorized command submission. Follow ConnectWise advisories for updates and remediation guidance.

Summary

The threat involves abuse of ConnectWise ScreenConnect, a remote-support platform, by threat actors who gained unauthorized access to cloud-hosted ScreenConnect instances belonging to MSPs. They use ScreenConnect commands to silently install additional remote-access clients connected to attacker infrastructure on customer endpoints. SCKit, a malicious worm, is deployed via a PowerShell decoder that uses device-specific keys to extract and install components. Persistence is established through scheduled tasks and registry entries. RelayTrap, a component of SCKit, targets technician workstations by delivering malicious payloads during support sessions, enabling attackers to remotely administer endpoints and deploy further tools independently of legitimate support. The attack exploits an authentication flaw in RMM+ extensions (versions 1.0.31 and 1.0.32) when no access key is set, allowing unauthorized command submission to the server API. ConnectWise has issued a fix for CVE-2026-84869 that blocks the endpoint-to-technician spread via RelayTrap. The attack chain involves server-side entry through extensions and client-side propagation targeting technician workstations. Defenders are advised to investigate affected technician workstations and endpoints, as removing unauthorized clients does not remove persistence or invalidate exposed sessions.

References

microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Nov 2026, 22:22 UTC

Technical details

References

Community reviews

Related threats