Image: microsoft.com · rights & removal

SCKit abuses ScreenConnect to deploy remote access and target technician sessions

Reporting by Microsoft Security BlogRead the original at microsoft.com

Executive Summary

A sophisticated threat actor has initiated an active campaign targeting cloud-hosted ConnectWise ScreenConnect instances utilized by Managed Service Providers (MSPs), beginning November 11, 2026. The attack leverages legitimate remote-support mechanisms to install unauthorized clients and deploy a malicious worm named SCKit onto managed endpoints. This malware establishes persistence via scheduled tasks and registry entries. While one entry point involves an authentication flaw in RMM+ extensions allowing API access without standard sign-in, the attacker also employs a distinct client-side attack path where compromised customer endpoints spread payloads to technician workstations during support sessions via a component called RelayTrap. Remediation requires specialized investigation across endpoint forensics, as simply removing unauthorized clients does not negate persistence or invalidate existing web sessions; administrators must isolate and rigorously audit both customer devices and connecting technicians' workstations.

Facts Only

ConnectWise reported an active threat actor campaign starting November 11, 2026. The attack targets cloud-hosted ConnectWise ScreenConnect instances used by MSPs. Threat actors are abusing the legitimate remote-support application to deploy SCKit and unauthorized remote-access clients. The deployment sequence on customer endpoints involves using ScreenConnect commands to download and install an MSI client connected to attacker infrastructure. A batch launcher then retrieves a PowerShell decoder that decrypts and extracts SCKit, establishing persistence via scheduled tasks and registry Run entries. RelayTrap aims to deliver payloads to technician workstations during supported sessions. The toolkit targets IT support technician workstations by hijacking authenticated ScreenConnect Sessions. Server-side access is also reported through an authentication flaw in RMM+ versions 1.0.31 and 1.0.32 if no access key was configured.

Full Take

The core narrative presents a complex technological siege—an abuse of trust inherent in remote support infrastructure to pivot from client endpoints into professional technician environments. The strongest depiction suggests that the attack is not merely a vulnerability exploitation, but a multi-stage process designed for deep lateral movement, using established digital workflows (remote command execution) as its delivery mechanism. This campaign mirrors historical patterns where administrative tools meant to enhance productivity are co-opted to achieve hostile goals—a classic case of weaponizing organizational trust. The assumption underwriting the response guidance is that an attacker's intrusion can be fully contained by endpoint isolation and credential rotation; however, the detailed description implies persistence mechanisms (scheduled tasks, registry entries) are designed precisely to survive such cursory remediation efforts.
The key pivot point lies in the difference between the server-side extension abuse path and the client-to-technician RelayTrap spread. If one accepts ConnectWise’s distinction, we see two independent attack surfaces being leveraged: API gateway compromise versus endpoint infection/session hijacking. The cost of failure is high; compromising a technician's workstation provides access to privileged management consoles across multiple customer accounts, exponentially increasing the blast radius beyond the initially compromised device.
What assumptions about security control efficacy must be challenged? Does "removing an unauthorized client" sufficiently address systemic persistence when configuration files (like exclusions) are being written through ostensibly legitimate processes? How might supply chain integrity—the very foundation of MSP operations—be hardened against this subtle form of infiltration that masks itself as necessary administrative traffic?
Patterns detected: none
Autonomy check: No autonomy signals.

From the original · Microsoft Security Blog

Beginning on November 11, 2026, ConnectWise reported an active campaign of a threat actor gaining unauthorized access to cloud-hosted ConnectWise ScreenConnect instances belonging to managed service providers (MSPs).

Read the full story at microsoft.com

Sentinel unavailable

The automated check of the source article's wording did not complete, so no result is shown.

This looks only at the wording of the original source article, not at this page's AI-written sections. A small local AI model made this estimate. It has not been checked against known human and machine texts, so treat it as provisional. It cannot show who wrote an article.