A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks.
The malware toolkit uses a worm-like technique that exploits a previously patched ScreenConnect vulnerability, CVE-2026-84869, to execute malicious code on a technician's workstation when they connect to an infected device. However, researchers at Huntress and Blackpoint Cyber say they have not observed successful exploitation of this flaw during the attacks, with Blackpoint confirming that the exploit failed in testing against a patched ScreenConnect client.
The findings follow yesterday's widespread ScreenConnect attacks, in which attackers gained unauthorized access to cloud-hosted ScreenConnect environments and used the platform's Run Command feature to install rogue ScreenConnect remote-access clients on customer endpoints. ScreenConnect is a remote access and support platform used by MSPs and IT teams to remotely manage and troubleshoot customer devices.
According to an updated Huntress report, the attacks compromised at least 288 endpoints across 48 organizations, with all of the affected devices targeted within 90 minutes. Approximately one-third of those systems were affected within the first 10 minutes. Huntress also believes the initial access was through RMM+, a third-party ScreenConnect extension that lets external management tools interact with ScreenConnect sessions without using the standard technician console.
The researchers found that RMM+ versions 1.0.31 and 1.0.32 contained an authentication flaw that could allow attackers to execute commands without authenticating to ScreenConnect or completing multifactor authentication. RMM+ uses a shared access key to authenticate requests rather than ScreenConnect's normal user accounts and authentication mechanisms. However, the vulnerable versions allowed the access key to remain blank if an administrator had never configured one.
SCKit attempts to spread through ScreenConnect sessions. In separate analyses, Huntress and Blackpoint Cyber examined SCKit, a collection of 16 scripts and components developed to establish persistent remote access and spread between systems managed through ScreenConnect. Blackpoint Cyber's Adversary Pursuit Group (APG) recovered the malware's loader directly from attacker-controlled infrastructure and decrypted subsequent stages to obtain the complete loader and a ScreenConnect installer used in the attacks.
The toolkit includes a component called RelayTrap, which is designed to replace the legitimate ScreenConnect Guest process running on an infected endpoint and wait for an MSP technician to establish an interactive connection. A separate component called TrapWatch monitors ScreenConnect services and prepares the replacement Guest process to intercept incoming support sessions.
When an MSP technician connects, RelayTrap attempts to send a malicious file in the opposite direction of a normal remote-support operation, from the infected customer endpoint to the technician's workstation. The technique attempts to exploit CVE-2026-84869, a critical ScreenConnect client-side file-transfer vulnerability that ConnectWise patched in version 26.6.5.
