A sophisticated worm-like toolkit dubbed SCKit has compromised at least 288 managed endpoints across 48 organizations in under 90 minutes by abusing ConnectWise ScreenConnect, one of the most widely used remote monitoring and management (RMM) platforms in the managed services industry. Security firm Huntress disclosed the campaign on November 12, 2026, after first detecting suspicious activity at approximately 17:47 UTC on November 11.
The incident is the latest — and arguably most aggressive — escalation of attacks targeting legitimate RMM tooling, and it carries urgent implications for every managed service provider (MSP) and IT team that relies on ScreenConnect.
What Happened
According to Huntress researchers, the attacker leveraged cloud-hosted ScreenConnect panels to push rogue client installations to target machines. Once installed, the operator used ScreenConnect’s built-in Run Command feature — which executes instructions as SYSTEM — to deploy payloads to groups of endpoints simultaneously. Roughly one-third of the 288 compromised hosts fell within the first 10 minutes of the campaign.
The attack chain follows a distinct pattern. Commands issued through the ScreenConnect panel downloaded an attacker-controlled MSI installer to C:\Windows\TEMP\sc.msi, installed it silently, and then wrote a base64-encoded dropper script named sckit-run.bat to the same directory. That dropper fetched a PowerShell decoder script and a machine-specific encrypted copy of the SCKit package — a 16-file bundle consisting of PowerShell, batch, and command scripts — from the attacker’s command-and-control infrastructure.
What makes SCKit distinctive is its per-host encryption model. Each victim machine sends its Windows UUID to the attacker’s server as a URL query parameter. In return, the server delivers a unique encryption key, initialization vector, and salt through the HTTP response headers, effectively ensuring that no two payloads are identical and making signature-based detection extremely difficult.
How the Worm Spreads
SCKit’s most concerning capability is its lateral movement mechanism, which targets the very technicians who would normally respond to an incident on a compromised host.
A component called TrapWatch.ps1 compiles a C# source file (RelayTrap.cs) into a host-specific executable and registers it as a scheduled task called TrapWatch. The legitimate ScreenConnect service is stopped and set to manual start, while the attacker’s rogue client takes over its connection slot — so the machine appears normal in the ScreenConnect dashboard.
When an IT technician connects to the infected endpoint via ScreenConnect to investigate, a second stage activates. A file transfer silently pushes a lateral-movement script called Run-Lateral-Full.bat to the technician’s own workstation. A companion PowerShell script, Panel-Lateral.ps1, steals the technician’s .aspxauth session cookie and replays it against the ScreenConnect management panel, potentially granting the attacker administrative access to the entire panel and all the endpoints it manages.
A further component, ToolboxRelayUploader.exe, uploads a payload to ScreenConnect’s Shared Toolbox and instructs every reachable session to execute it before deleting the uploaded item roughly 60 seconds later. Huntress notes that while they have not yet observed this panel-takeover jump succeed in the wild, and the console-takeover attempt failed in every recovered host log, the design clearly intends to enable self-propagating, worm-like spread across an MSP’s entire client base.
The Root Cause: A Third-Party Extension Flaw
Huntress traced the initial access to RMM+, a third-party ScreenConnect extension. Versions 1.0.31 and 1.0.32 of RMM+ accepted a blank access key if an administrator had never configured one. This default-open state bypassed ScreenConnect’s own accounts, roles, and multi-factor authentication entirely.
In response, ConnectWise identified five third-party extensions potentially associated with the activity and disabled them across approximately 400 partner environments. ConnectWise has stated that there is no evidence of a vulnerability in ScreenConnect itself or a compromise of its own infrastructure, and that its investigation into the initial access method is ongoing.
Huntress researchers also noted that code analysis of the SCKit toolkit suggests portions of it were generated using a large language model (LLM), as the embedded C# source code contains unusually detailed inline comments explaining each operational step — a hallmark of AI-assisted code generation.
Who Is Affected
The 48 affected organizations span multiple sectors, though specific victims have not been named. Because ScreenConnect is primarily used by MSPs to manage client infrastructure, the blast radius of such an attack can be enormous. A single compromised panel can provide access to hundreds or thousands of downstream endpoints belonging to the MSP’s clients.
The affected ScreenConnect builds include current releases (versions 26.6.6.9747 and 26.7.6.9783), meaning organizations running fully patched ScreenConnect deployments were still vulnerable through the third-party extension weakness.
Practical Takeaways
Do not connect to suspected infected hosts via ScreenConnect. The worm’s lateral movement trap is specifically designed to compromise technician workstations during a remote support session. Use EDR live response, WinRM, or another out-of-band investigation tool instead.
Isolate and clean affected hosts thoroughly. Huntress recommends reimaging from known-good media, as reinfection has been observed after isolation is lifted. Remove the rogue ScreenConnect client, the TrapWatch scheduled task, the C:\ProgramData\RelayTrap\ directory, and the RelayTrapLiteAlert Run key from the registry.
Audit your ScreenConnect extensions immediately. Verify that every third-party extension has a configured access key. Do not re-enable any extensions that ConnectWise has disabled. Review extension permissions and remove any that are not strictly necessary.
Rotate credentials from a clean device. Revoke all ScreenConnect sessions and identity-provider sessions. Rotate all administrative credentials. Audit Run Command and Shared Toolbox history for signs of unauthorized activity.
Review Defender exclusions. SCKit adds Windows Defender exclusions as part of its installation. Check for and remove any unauthorized exclusion paths on all managed endpoints.
What to Watch Next
The SCKit campaign represents a troubling evolution in how attackers weaponize RMM platforms. Rather than exploiting a vulnerability in ScreenConnect’s core product, the attacker found a soft spot in the extension ecosystem — a pattern that mirrors the broader trend of supply chain attacks targeting developer tools and plugin marketplaces throughout 2026.
ConnectWise’s investigation is ongoing, and further details about the initial access method and any additional affected extensions may emerge in the coming days. Organizations using any RMM platform — not just ScreenConnect — should treat this as a wake-up call to audit third-party integrations, enforce strict access key configurations, and ensure that incident response playbooks account for the possibility that the management tool itself could be the attack vector.
Sources: Huntress, GBHackers, ConnectWise Security Advisory, SecurityWeek
Leave a Reply