New SCKit Worm Targets ConnectWise ScreenConnect, Infecting 288 Endpoints Across 48 Organizations

A worm-like toolkit called SCKit has compromised at least 288 managed endpoints across 48 organizations through abused ConnectWise ScreenConnect panels.

Huntress researchers say the operator pushed rogue clients through cloud-hosted panels, giving the attacker persistent remote access and a trap for stealing technician session cookies.

The affected builds include the latest releases, 26.6.6.9747 and 26.7.6.9783. The activity echoes earlier rogue ScreenConnect clients that spread worm-like malware across connected Windows systems.

Huntress first saw suspicious activity at 17:47 UTC on November 11, 2026. All 288 hosts were hit within 90 minutes, and roughly one third fell in the first 10 minutes.

The attacker used the panel’s Run command feature to send instructions to groups of endpoints at once, running as SYSTEM. The commands downloaded an attacker-controlled installer to C:\Windows\TEMP\sc.msi, installed it silently, and wrote a base64-encoded dropper, sckit-run.bat, to the same folder.

The dropper fetches sckit-decoder.ps1 and a machine-specific encrypted copy of SCKit, a 16-file package of PowerShell, batch, and command scripts. The server ties the kit to each victim by receiving the Windows UUID in the URL query string.

It returns the key, initialization vector, and salt in its response headers. Abuse of this kind of trusted tooling is growing, as seen when MSP360 and ScreenConnect RMM tools were abused in phishing campaigns.

TrapWatch.ps1 compiles RelayTrap.cs into a host-specific executable and creates a scheduled task named TrapWatch. The legitimate ScreenConnect service is stopped and set to manual start. The attacker’s client takes over its connection slot, so the machine still looks normal. The installer also adds Defender exclusions and a second rogue client.

Researchers believe an LLM generated the C# source, because its explain each step in detail. Attackers have used similar tactics before, such as Power BI phishing that installed multiple RMMs to maintain persistent access.

Code analysis shows a second stage designed to wait for a technician to connect to an infected host. A file transfer then pulls Run-Lateral-Full.bat to the technician’s workstation. Panel-Lateral.ps1 steals the .aspxauth session cookie and replays it against the panel.

ToolboxRelayUploader.exe then uploads a payload to the Shared Toolbox and tells every reachable session to run it, and deletes the item 60 seconds later. Huntress has not seen this jump succeed, and the console-takeover attempt failed in every recovered host log. Earlier, ConnectWise patched a critical file-transfer flaw in ScreenConnect , showing how attractive the platform is to attackers.

ConnectWise found five third-party extensions that may be associated with the activity and disabled them across 400 partner environments, according to its security advisory.

Huntress later tied the activity to RMM+. Versions 1.0.31 and 1.0.32 accepted a blank access key when an administrator never configured one, bypassing ScreenConnect accounts, roles, and MFA. ConnectWise says it has found no ScreenConnect vulnerability or compromise of its own infrastructure, and it is still investigating the initial access method.

Defenders should avoid connecting to suspected hosts via ScreenConnect, as an interactive session could inadvertently spread malware to the technician’s workstation. Instead, use EDR live response, WinRM, or another out-of-band tool.

Isolate any affected hosts until cleanup is complete, as reinfection has been reported after isolation is lifted. Remove the rogue client, the TrapWatch task, the folder located at C:\ProgramData\RelayTrap\, and the RelayTrapLiteAlert Run key.

From a clean device, revoke ScreenConnect and identity-provider sessions, rotate credentials, and audit the Run Command and Toolbox history. Do not re-enable any disabled extensions.

Indicators of Compromise (IOCs)

File hashes are weak indicators here, because the scripts are rebuilt with different embedded values and the trap executable is compiled on each host.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs :

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Node.js Patches 16 Security Vulnerabilities Allowing Remote Server Crashes, Memory Leaks, and Authentication Bypass

New Citrus Ransomware Hides Malicious Traffic as HTTPS to Evade Corporate Network Security

Criminal IP Launches New TI Feed App on Splunkbase for Automated Threat Detection

Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites

N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers

BluePhishing Attack Abuses Microsoft Entra OAuth Consent to Create Hidden AI Agent Identities