ScreenConnect Attacks Deploy SCKit Malware Across MSP Environments, Targeting 288 Endpoints in 48 Organizations

Executive Summary

A newly identified malware toolkit named SCKit targets Managed Service Providers (MSPs) with a collection of 16 scripts and components designed to establish persistent remote access and propagate across managed environments.

The toolkit introduces a worm-like attack mechanism that attempts to turn an infected customer endpoint into an entry point for compromising an MSP technician's workstation. Its capabilities include support-session interception, authentication cookie theft, and abuse of existing management permissions to access additional customer endpoints.

Although the toolkit contains components designed to facilitate propagation across MSP-managed networks, researchers have not observed successful exploitation of its intended worm-like mechanism during the investigated campaign.

Background

ScreenConnect is a remote access and support platform used by MSPs and IT teams to manage and troubleshoot customer devices.

The campaign involved unauthorized access to cloud-hosted ScreenConnect environments and the abuse of a third-party extension authentication weakness. The affected extension could accept an empty shared access key when administrators had not configured one, allowing attackers to execute remote commands without completing the standard authentication or multifactor authentication process.

SCKit also attempts to exploit CVE-2026-84869, a critical ScreenConnect client-side file-transfer vulnerability. The flaw could allow a malicious Guest process to transfer a file to an MSP technician's workstation and potentially trigger its execution. The vulnerability was addressed in ScreenConnect version 26.6.5.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Product	Vulnerability Type
CVE-2026-84869	9.9 (Critical)	0.92%	ScreenConnect Client all versions prior to 26.6.5	Client-Side File Transfer Vulnerability

Attack Methodology

Phase 1: Initial Access

Attackers gained unauthorized access to cloud-hosted ScreenConnect environments and abused the Run Command feature to execute commands across managed customer endpoints. The activity was associated with an authentication weakness in a third-party extension that could accept an empty shared access key when it had not been configured.

Phase 2: Persistent Access Deployment

Attackers installed additional ScreenConnect Access clients configured to communicate with attacker-controlled servers. These clients provided an independent remote-access channel that could remain active even after the original MSP support session was terminated.

Phase 3: RelayTrap Installation

SCKit deployed RelayTrap, a component designed to replace the legitimate ScreenConnect Guest process on infected customer devices. The attackers hosted its C# source code, named RelayTrap.cs, on their infrastructure. A PowerShell script downloaded and compiled the source locally into an executable.

Phase 4: Support Session Interception

Another component, TrapWatch, monitored ScreenConnect services and prepared the replacement Guest process to intercept incoming support sessions. When a technician connected to an infected endpoint, RelayTrap attempted to transfer a malicious file to the technician's workstation by exploiting CVE-2026-84869.

Phase 5: Authentication Cookie Theft

Additional SCKit components attempted to steal ScreenConnect authentication cookies stored in web browsers on compromised technician workstations. These cookies could allow attackers to hijack authenticated management sessions without obtaining credentials or completing another MFA challenge.

Phase 6: Propagation Across Managed Networks

Using the technician's existing ScreenConnect permissions, SCKit attempted to enumerate accessible endpoints and distribute malicious commands through legitimate management features, including the Shared Toolbox. This was designed to extend the compromise from an infected customer endpoint to the MSP technician and other customer environments managed by the same service provider.

Campaign Impact and Research Findings

The campaign affected at least 288 endpoints across 48 organizations. All affected devices were targeted within a 90-minute period, with approximately one-third affected within the first 10 minutes.

Analysis of the recovered toolkit revealed extensive comments in the RelayTrap source code describing its functionality, compatibility workarounds, and previous coding errors. The code also appeared to have been generated using a large language model.

Researchers reproduced the attempted exploitation of CVE-2026-84869 against a current ScreenConnect client. Although the Guest process queued the file transfer, the client did not request or execute the malicious payload because the existing security fix prevented execution.

The recovered host logs also showed that attempted console takeover had failed. Consequently, although SCKit contains components designed to propagate across MSP-managed environments, successful exploitation and worm-like propagation were not observed during the investigated campaign.

Visual Attack Flow

Indicators of Compromise (IoCs)

The investigation identified network indicators, malicious file hashes, suspicious filenames, persistence artifacts, and unauthorized ScreenConnect client identifiers associated with SCKit.

Network Indicators

Indicator	Type	Description
185.99.255[.]28	IP Address	Attacker-controlled ScreenConnect server hosting the client installer
155.94.150[.]39	IP Address	Attacker-controlled ScreenConnect panel
ns[.]mo7sen[.]dev	Domain	Initial staging and payload delivery infrastructure
sc[.]payproofkit[.]com	Domain	Rogue ScreenConnect deployment infrastructure
cdn007-digitaldownloads[.]com	Domain	Command-and-control infrastructure
newnewnew[.]gotdns[.]org	Domain	Attacker-controlled relay
soxnewwork[.]homedns[.]org	Domain	Attacker-controlled relay used by a rogue ScreenConnect client
hxxps://ns[.]mo7sen[.]dev/EadF.php?p=4	URL	Payload staging endpoint

File Indicators

Filename	SHA-256
Stage0Loader.ps1	81cc2baa35b798d6084bd078662fa29ff28df02c46c6ccdb2b43bde97d19f781
RelayTrap.cs	3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4
TrapWatch.ps1	d2ed7a7bf4f8ac9c7969e9b3a07ebd4dda0d858f372c876ac0a041611698de9a
Panel-Lateral.ps1	7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec
Panel-Lateral-free.ps1	94b93c649b0ae0281352da9d01761fa9195ab1e6ac7010af3b9ba1646355eb11
ToolboxRelayUploader.exe	8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af
ScreenConnect.ClientSetup.msi	d85315bd7602b6f5c13dc0eada2c9cba0892c7cd3b1eb7dacb1bffdd536ceb21

Host-Based Indicators

Indicator	Description
C:\ProgramData\RelayTrap	Malware installation and persistence directory
C:\ProgramData\RelayTrap\TrapWatch.ps1	Persistent PowerShell component
%TEMP%\sckit-*	Malware staging directories
TrapWatch	Scheduled task executing with SYSTEM privileges
RelayTrapLiteAlert	Registry Run-key persistence value
2588ef5c15954b10	Rogue ScreenConnect client identifier
ed630cc2c873b091	Additional rogue ScreenConnect client identifier
Addmin, rmmserver	Attacker-associated account or operator names

The file hashes should be treated as supplementary detection indicators because certain scripts contain host-specific values and the RelayTrap executable is compiled separately for individual systems.

Mitigation

Organizations using ScreenConnect should apply the following security measures to reduce exposure and investigate potential SCKit infections.

1. Update ScreenConnect Clients: Upgrade ScreenConnect clients to version 26.6.5 or later. Ensure technician Host clients and Access agents are updated, including those connected to cloud-hosted environments.

2. Disable Affected Third-Party Extensions: Disable potentially affected third-party ScreenConnect extensions and review their authentication configurations to prevent unauthorized remote command execution.

3. Restrict File Transfers: If immediate patching is not possible, temporarily remove the TransferFiles permission from affected ScreenConnect session roles until the security update is applied.

4. Review Remote Access Activity: Investigate unauthorized ScreenConnect client installations and examine Run Command, Shared Toolbox, extension installation, and administrative activity for suspicious operations.

5. Investigate Compromised Endpoints: Avoid initiating interactive ScreenConnect sessions with potentially infected endpoints. Use separate security tools or out-of-band investigation methods to examine affected systems.

6. Remove Malicious Persistence: Investigate and remove unauthorized ScreenConnect clients, the TrapWatch scheduled task, suspicious registry entries, and associated malware files after preserving relevant forensic evidence.

7. Secure Technician Accounts: Revoke potentially compromised ScreenConnect sessions, invalidate associated identity-provider sessions, reset affected credentials, and enforce multifactor authentication.

8. Isolate Affected Systems: Isolate compromised endpoints and technician workstations until investigation and remediation are complete. Verify that unauthorized remote-access components and persistence mechanisms have been removed before restoring connectivity.