Ethical Hacking News
A sophisticated malware campaign, known as SCKit, has been linked to a wave of coordinated attacks against managed service providers (MSPs) and their clients. The attacks, which exploit a critical vulnerability in ScreenConnect, aim to establish persistent remote access and extend the intrusion to other systems controlled by the same technician. MSPs and their clients are urged to prioritize patching, strong operator-session protections, and thorough investigation of management relationships to prevent and respond to such attacks effectively.
Recent cyber attacks against MSPs and clients attributed to a malware campaign exploiting a critical vulnerability in ScreenConnect.Vulnerability allows attackers to execute commands without authorization, bypassing multi-factor authentication.SCKit malware uses vulnerability to hijack authenticated operator sessions and push malicious code using legitimate ScreenConnect features.Attackers target technicians with access to managed endpoints and administrative tools.Patch ScreenConnect clients to prevent execution of exploit's payload, but not eliminate risks associated with compromised operator sessions.Importance of stronger operator-session protections and tighter session validation, including additional authentication for bulk administrative actions.Avoidance of rogue Access installations, administrative command history, technician workstations, and browser sessions are crucial in investigation.Identification of a serious authentication flaw in RMM+ extension, which allows unauthorized commands to execute without authentication controls.
The latest wave of cyber attacks against managed service providers (MSPs) and their clients has been attributed to a sophisticated malware campaign that exploits a critical vulnerability in the remote access software ScreenConnect. According to a report by Blackpoint Cyber's Adversary Pursuit Group (APG), the SCKit malware takes advantage of a now-patched privilege escalation vulnerability in ScreenConnect, CVE-2026-84869, to gain unauthorized access to endpoints and extend the intrusion to other systems controlled by the same technician.
The vulnerability, which has a CVSS score of 9.9, allows an attacker to execute commands without authorization or host confirmation, effectively bypassing multi-factor authentication. The SCKit malware uses this vulnerability to file transfer and execute malicious payload through active remote sessions, which can be leveraged to hijack authenticated operator sessions and push malicious code using legitimate ScreenConnect management features.
The attack sequence begins with the execution of a batch script dropper, "sckit-run.bat", which downloads and runs an attacker-controlled MSI installer. This installer subsequently contacts a PowerShell decoder, "sckit-decoder.ps1", to fetch a PowerShell script used to establish persistent remote access by deploying unauthorized ScreenConnect Access clients. The malware also includes scripts and C# code designed to interfere with existing ScreenConnect Guest sessions, including RelayTrap, a component that allows the malware to intercept legitimate support connections and extend the intrusion to other endpoints.
The SCKit malware appears to target technicians, who regularly connect to managed endpoints belonging to different customers, typically from workstations with access to administrative tools and authenticated management sessions. This enables the attackers to break out of the original endpoint and move the intrusion into an environment with potentially broader access and privileges.
The attack sequence makes use of the platform's built-in Run Command functionality to execute commands, which involves checking for an existing ScreenConnect installation before downloading and running the attacker-controlled MSI installer. The attacker-controlled MSI installer subsequently contacts "ns.mo7sen[.]dev" to fetch a PowerShell decoder, which ultimately deploys various components associated with the SCKit toolkit.
In response to the latest incident, ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments, while Blackpoint Cyber's APG researchers have confirmed that testing against a fully patched ScreenConnect client successfully prevents execution of the exploit's payload. However, the researchers have noted that patching addresses the known exploit, but it does not eliminate the risks associated with a compromised operator session.
The findings reinforce the importance of patching ScreenConnect clients, and underscore the need for stronger operator-session protections, including tighter session validation and additional authentication for bulk administrative actions. The researchers have also emphasized the need for MSPs to investigate the management relationship, not only the endpoint, as rogue Access installations, administrative command history, technician workstations, and browser sessions all deserve attention, especially when support personnel have already connected to a suspected system.
Furthermore, a recent update by Huntress has identified a serious authentication flaw in versions 1.0.31 and 1.0.32 of RMM+, one of the five third-party ScreenConnect extensions that has already been blocked by ConnectWise. The flaw, which allows unauthorized commands to execute without going through ScreenConnect's normal authentication controls, was discovered by Huntress, which stated that the extension would accept a blank access key when an administrator had not configured an access key, potentially allowing attackers to bypass multi-factor authentication.
The SCKit malware campaign highlights the importance of vigilance and proactive security measures in the face of increasingly sophisticated cyber attacks. As MSPs and their clients continue to navigate the complex landscape of remote access security, it is essential to prioritize patching, strong operator-session protections, and thorough investigation of management relationships to prevent and respond to such attacks effectively.
Related Information:
https://www.ethicalhackingnews.com/articles/SCKit-Malware-Exploits-Vulnerability-in-ScreenConnect-to-Launch-Coordinated-Attacks-Against-MSPs-and-Their-Clients-ehn.shtml
https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html
https://nvd.nist.gov/vuln/detail/CVE-2026-84869
https://www.cvedetails.com/cve/CVE-2026-84869/
Published: Thu Nov 12 14:28:32 2026 by llama3.2 3B Q4_K_M
