Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware
Attackers compromised cloud-hosted ConnectWise ScreenConnect panels, deploying SCKit malware to 288 devices across 48 organizations by exploiting the Run command feature with SYSTEM privileges.
Attackers have successfully hijacked cloud-hosted ConnectWise ScreenConnect panels, leveraging them to distribute a custom malware toolkit known as SCKit to a significant number of managed devices. Security firm Huntress reported that the malicious activity impacted at least 288 devices across 48 organizations, with a rapid deployment observed, as approximately one-third of the affected hosts were compromised within the first 10 minutes of the campaign's initiation. The attackers exploited the 'Run command' feature within the ScreenConnect panel, which allowed them to execute commands with SYSTEM-level privileges on numerous endpoints simultaneously.
The initial command executed by the attackers was designed to detect an existing ScreenConnect client on the target machine. Following this detection, a rogue installer, disguised as 'sc.msi', was downloaded to the C:\Windows\TEMP\ directory and silently installed. This operation highlights a sophisticated approach to initial access and malware deployment, bypassing standard security measures by utilizing legitimate administrative tools for malicious purposes. Huntress is actively collaborating with ConnectWise to investigate the full scope and attribution of this incident.
ConnectWise has identified five third-party extensions that may be linked to this activity: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. These extensions provide an API capable of executing remote commands, protected by a passphrase set by the partner. While the presence of these extensions does not confirm a breach, ConnectWise has proactively disabled them in approximately 400 partner environments as a precautionary measure. The company has stated that its own systems were not compromised and that no inherent flaw in ScreenConnect itself has been identified, though specific versions, including 26.6.6.9747 and 26.7.6.9783, are reportedly affected.
For partners hosting their own ScreenConnect servers, the responsibility falls on them to disable these extensions, as ConnectWise cannot perform this action remotely. The SCKit malware package itself is comprised of 16 distinct files, including PowerShell scripts, batch files, and configuration data. A notable feature of the malware is its method of communication: the infected machine sends its Windows ID to an attacker-controlled server, which then responds with a unique decryption key for a payload tailored to that specific machine. This personalized payload delivery makes traditional file hash-based detection methods less effective.
Further analysis of the SCKit toolkit reveals advanced evasion and persistence techniques. The malware installs a secondary, rogue ScreenConnect client and configures Microsoft Defender to exclude certain files and directories, thereby hindering antivirus detection. It also establishes a persistence mechanism through a scheduled task named 'TrapWatch,' which replaces the legitimate ScreenConnect client with the attacker's malicious version, ensuring continuous control while maintaining a facade of normal operation for administrators. Intriguingly, Huntress noted that parts of the C# code for a component called 'RelayTrap' appear to have been generated using an AI model.
The SCKit toolkit also includes a secondary objective focused on session hijacking. The malware is designed to detect when a legitimate technician connects to an infected device. Upon detection, it attempts to download a dropper onto the technician's workstation and steal the '.aspxauth' session cookie. With this stolen cookie, the attackers aim to gain access to all other sessions the technician can initiate and upload malicious payloads to the ScreenConnect panel's 'Shared Toolbox.' While Huntress has not yet observed successful exploitation of this session hijacking capability, its inclusion in the toolkit underscores the advanced threat posed by this campaign.
This incident is not the first time ScreenConnect has been exploited. In September, similar worm-like rogue clients were observed spreading staged scripts between Windows machines. Additionally, CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog, a flaw that allowed unauthorized file transfers during active sessions. While ConnectWise has since patched this vulnerability, the recurring exploitation of ScreenConnect highlights the need for continuous vigilance and prompt patching.
Huntress and ConnectWise recommend immediate actions for affected organizations. They advise against connecting to suspect machines via ScreenConnect, suggesting the use of alternative tools like EDR live response or WinRM for incident investigation. Essential cleanup steps include isolating affected hosts, removing the rogue client, the TrapWatch task, the RelayTrap folder, and the RelayTrapLiteAlert Run key. Administrators should also review Run Command and Toolbox history for unauthorized jobs and revoke active web sessions while rotating credentials from a clean device. Indicators of compromise include specific domains (newnewnew.gotdns[.]org, soxnewwork.homedns[.]org, cdn007-digitaldownloads[.]com, ns.mo7sen[.]dev), an IP address (185.99.255[.]28), and the participant name 'Addmin'.
This new report details that attackers have targeted at least 288 endpoints across 48 organizations, with some of the malicious activity observed as early as November 11, 2026. The attackers are reportedly using a custom toolkit called SCKit, which is delivered as an encrypted payload and includes components for establishing persistence, adding Microsoft Defender exclusions, and potentially installing a second attacker-controlled ScreenConnect client. Furthermore, analysis of the malware suggests that at least one of the scripts may have been generated by a large language model.