SCKit Targets ScreenConnect Support Sessions in MSP Attack Paths

TL;DR - SCKit activity targeted ConnectWise ScreenConnect deployments with rogue remote access clients. - Huntress reported at least 288 affected endpoints across 48 organizations. - The toolkit attempted to use technician sessions as a route to additional managed environments. - CISA lists CVE-2026-84869, a ScreenConnect vulnerability, in its Known Exploited Vulnerabilities Catalog. - Blackpoint Cyber reported that its controlled test against a current ScreenConnect Host client did not execute the attempted payload.

What happened#

SCKit is a toolkit associated with activity targeting ConnectWise ScreenConnect deployments. Huntress reported that operators used the Run command feature on cloud-hosted ScreenConnect panels to install attacker-controlled ScreenConnect clients and deploy SCKit to managed endpoints.

The reported deployment sequence checked for an existing ScreenConnect client, downloaded an attacker-controlled installer to C:\Windows\TEMP\sc.msi, installed it silently, and wrote a Base64-encoded dropper to C:\Windows\Temp\sckit-run.bat. The dropper downloaded additional PowerShell content and retrieved a system-specific version of the toolkit.

Huntress reported at least 288 managed endpoints across 48 organizations. It observed all 288 hosts being impacted over 90 minutes, with about one third affected in the first 10 minutes.

The toolkit also included functionality intended to move from an infected endpoint toward a technician’s workstation and then to other endpoints accessible through the technician’s ScreenConnect session. Blackpoint Cyber reported that SCKit’s RelayTrap component attempts to replace a legitimate ScreenConnect Guest and send a file toward the connecting technician for execution. Follow-on components attempt to recover .ASPXAUTH cookies and reuse technician permissions.

This creates a potential path from one managed endpoint to other customer environments administered through the same support infrastructure. The reported session-takeover and Guest-to-Host propagation behavior was not observed to succeed in the investigations described by Huntress and Blackpoint Cyber.

Are you affected#

Organizations using ConnectWise ScreenConnect should review whether unfamiliar ScreenConnect clients, deployments, or connections appeared in their environments during the activity reported on November 11, 2026.

Huntress specifically reported activity involving cloud-hosted ScreenConnect panels and said the most current versions of its remote monitoring and management software, 26.6.6.9747 and 26.7.6.9783, were affected by the observed activity. Huntress also reported that the activity appeared related to the third-party RMM+ extension.

According to Huntress, RMM+ versions 1.0.31 and 1.0.32 contained an authentication flaw. If an administrator had never configured the extension’s access key, RMM+ would accept a blank one. Huntress said RMM+ bypasses ScreenConnect user accounts, roles, and multifactor authentication, using a shared access key stored in the extension’s settings.

ConnectWise identified five independent third-party extensions that may be associated with the activity and disabled them across more than 400 partner environments as a precaution, according to Huntress. The listed extensions were Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link.

CISA lists CVE-2026-84869, described as a ConnectWise ScreenConnect improper privilege management and missing authorization vulnerability, in its Known Exploited Vulnerabilities Catalog.

What is confirmed and what is reported#

What defenders should do now#

1. Review ScreenConnect panels and endpoint inventories for unfamiliar ScreenConnect clients, unexpected deployments, and connections to infrastructure outside the organization’s legitimate management environment.

2. Review ScreenConnect Run command activity and logs for commands that downloaded sc.msi, sckit-run.bat, sckit-decoder.ps1, or related PowerShell content.

3. Review endpoints for the paths reported by Huntress, including C:\Windows\TEMP\sc.msi, C:\Windows\Temp\sckit-run.bat, and files extracted under C:\ProgramData\Relay.

4. Treat connections to unfamiliar machines as unsafe and avoid using ScreenConnect to triage infected hosts, as recommended by Huntress.

5. Inventory third-party ScreenConnect extensions. Huntress reported that ConnectWise disabled Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link across hosted environments as a precaution, and urged on-premises partners to do the same.

6. For RMM+ deployments, review whether an access key was configured and investigate versions 1.0.31 and 1.0.32, which Huntress reported accepted a blank key when none had been configured.

7. Prioritize remediation of CVE-2026-84869. CISA encourages organizations to prioritize vulnerabilities in its Known Exploited Vulnerabilities Catalog.

8. Review technician workstations and managed environments for unexpected authenticated session activity, unusual ScreenConnect commands, and signs that browser session cookies or technician permissions were accessed.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: support.microsoft.com
• Primary notice: cisa.gov
• Primary notice: msrc.microsoft.com
• Research: blackpointcyber.com
• Research: huntress.com
• Report: thehackernews.com