Attackers deployed SCKit malware in a November 11 campaign that compromised at least 288 customer devices across 48 organizations. The toolkit also tried to spread from infected devices to managed service providers’ technicians during support calls, but researchers found no evidence that it succeeded.
The attackers reached all 288 devices within 90 minutes. Roughly a third of the devices came under attack in the first 10 minutes. Through cloud-hosted ScreenConnect environments, the attackers installed additional remote-access clients that connected to servers they controlled. These clients gave them a way back into customer devices even after a technician ended the original support session.
Investigators trace suspicious commands to RMM+
Researchers identified RMM+, a third-party ScreenConnect extension, as the likely entry point. The extension lets external management tools interact with customer devices. Investigators found an authentication flaw in versions 1.0.31 and 1.0.32 that could allow unauthorized commands. Logs from several affected environments linked the commands to RMM+, with no corresponding technician sign-ins.
In response, ConnectWise disabled five potentially related third-party extensions across approximately 400 partner environments. That figure reflects the scope of the precaution. ConnectWise said the presence of an extension alone did not establish that attackers had accessed a partner’s systems.
SCKit malware tries to spread through support sessions
A technician would ordinarily open a ScreenConnect session to troubleshoot a customer’s device. SCKit tried to use that moment to target the technician’s own workstation through a file-transfer flaw, CVE-2026-84869. If the attempt succeeded, the attackers could potentially take over the technician’s signed-in management session and reach devices at other customer organizations.
ConnectWise had already patched the flaw in ScreenConnect version 26.6.5. In testing, researchers saw the infected device queue a file transfer, but the patched technician client neither requested nor ran the file. A separate review of logs from affected devices found that every recorded attempt to take over a technician’s console had failed.
For providers investigating the incident, the unauthorized remote-access clients remain a concern even where the technician’s workstation blocked the transfer. Researchers advised providers to check customer devices for unexpected ScreenConnect installations and review activity in the platform’s Run Command and Shared Toolbox features. They also recommended updating technician clients, disabling affected extensions and using a separate security tool to examine suspected infections before opening another interactive support session.
0 responses to “SCKit malware targets technicians in ScreenConnect attacks”