Hari 
A worm-capable toolkit called SCKit has compromised 288 managed endpoints across 48 organizations. Huntress began observing the activity around 17:47 UTC on November 11, 2026. All 288 hosts were hit within 90 minutes, and roughly a third of them in the first 10 minutes.
The operator abused cloud-hosted ScreenConnect panels to push commands to groups of endpoints, installing rogue ScreenConnect clients alongside the toolkit.
SCKit Worm Exploit
ConnectWise tied the activity to five third-party extensions and disabled them across more than 400 partner environments. Huntress traced the access to RMM+, specifically versions 1.0.31 and 1.0.32. The extension bypasses ScreenConnect user accounts, roles, and MFA, and authenticates requests with a shared access key.
In those builds the key defaulted to an empty string, and the check did not reject a blank value. An unauthenticated caller could therefore reach the extension’s command functions. The logs show commands landing on endpoints within minutes, with no matching login events.
The operator then used the Run Command feature to execute as SYSTEM. The command checked for an existing client, pulled an attacker-controlled installer to C:\Windows\TEMP\sc.msi, and installed it silently.
It then wrote a base64-encoded dropper, sckit-run.bat, which fetched sckit-decoder.ps1. This pattern resembles the post-exploitation framework behind GhostFrame, where legitimate administrative tooling becomes the persistence layer.
SCKit is a 16-file package of PowerShell, batch, and CMD scripts delivered as an encrypted payload. The infected host supplies its own decryption material. The loader passes the Windows machine GUID in the query string, and the server answers with an encryption key, initialization vector, and salt in the response headers.
Each kit is therefore bound to one machine, and file hashes are weak indicators. The scripts are rebuilt with different embedded values, and the trap binary is compiled separately on every host.
Persistence centers on RelayTrap. TrapWatch.ps1 runs as SYSTEM, compiles RelayTrap.cs into a host-specific executable, and registers a scheduled task named TrapWatch. It stops the legitimate ScreenConnect service, sets it to manual start, and takes over its relay connection slot.
Defender exclusions are added, and a second rogue client is installed. This relay-takeover design mirrors the AI-assisted C2 channel tradecraft documented in NotC2, where the channel hides inside trusted infrastructure. Huntress also noted that the RelayTrap source appears to be LLM-generated, given its verbose comments.
The lateral stage is designed to trigger when a technician connects to an infected host. A file transfer fires 2.5 seconds after the session opens and retrieves Run-Lateral-Full.bat. Panel-Lateral.ps1 then steals the .aspxauth session cookie and replays it against the panel.
That is the same MFA-bypassing session hijack seen in UAT-11985, applied to an RMM console. With the resulting tokens, ToolboxRelayUploader.exe uploads WithUninstall.ps1 to the Shared Toolbox, broadcasts it to every reachable session, and deletes it after about 60 seconds. Huntress has not observed this chain succeed. The console-takeover attempt failed on every recovered host log.
Responders should not triage suspected hosts over ScreenConnect, since an interactive session can trigger the spread. Use EDR live response or WinRM instead. Isolate the host, then remove the rogue client service, the TrapWatch task, C:\ProgramData\RelayTrap\, and the RelayTrapLiteAlert Run key.
Reinfection after isolation was lifted has been observed, so confirm cleanup before returning a host to service. Terminate active panel sessions, rotate credentials, and audit Run Command and Toolbox history for executions no technician initiated.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
1 thought on “SCKit Worm Exploits ScreenConnect RMM+ Flaw to Hijack 288 Endpoints Across 48 Organizations”