SCKit campaign targets MSP ScreenConnect environments

Threat summary

On November 11, 2026, ConnectWise published an advisory stating it was investigating reports of unauthorized access to ScreenConnect partner accounts and the deployment of unauthorized remote-access software in customer environments.

Its initial assessment indicates the activity may involve abuse of independently developed third-party extensions installed in partner environments. ConnectWise reported no evidence of compromise of its own infrastructure and no vulnerability in ScreenConnect itself. The initial access method and full scope remain under investigation.

ScreenConnect is a remote monitoring and management (RMM) platform used to remotely access, administer, and support endpoints through a centralized web console. Technicians can execute commands, transfer files, and deploy scripts across managed systems, and additional functionality can be added through the Extensions marketplace.

The affected RMM+ family of extensions exposes an application programming interface (API) capable of executing remote commands, protected by a passphrase configured by the partner. Cloud-hosted ScreenConnect instances are internet-accessible by design, and on-premises deployments have similar exposure when published externally.

The activity began at approximately 17:47 UTC on November 11. At 22:45 UTC, ConnectWise confirmed the activity and, as a precaution, disabled five extensions:

• Labtech Plus

• RMM Plus

• RMM+

• RMM Plus Password Link

• RMM+ Password Link

ConnectWise identified approximately 400 partner environments with at least one affected extension installed. 

Separately, researchers investigating the incident reported deployment of a malware framework known as SCKit. Observed activity included:

• Remote command execution through ScreenConnect

• Installation of unauthorized ScreenConnect clients

• Establishment of persistence

• Communication with adversary-controlled infrastructure

Researchers tracked the activity across at least 288 endpoints belonging to 48 organizations within a period of approximately 90 minutes.

The commands executed with SYSTEM privileges, allowing the threat actor to create Microsoft Defender exclusions, establish persistence through a scheduled task named TrapWatch, and stop the legitimate ScreenConnect client so the rogue client could assume its role. Researchers observed sequential numbering assigned to compromised providers, suggesting activity may have affected additional environments before discovery. Sophos reported similar activity originating from three ScreenConnect instance identifiers.

Researchers also identified functionality within SCKit designed to collect ScreenConnect session information and target technician workstations. Analysis of the malware revealed a second-stage propagation mechanism that attempts to capture an active ScreenConnect technician session and use it to distribute payloads to other systems accessible through that technician. Researchers reported that these console takeover attempts failed in every recovered incident examined to date. Portions of the code appear to have been generated with assistance from a large language model (LLM).

BleepingComputer reported that a malicious batch file uploaded to VirusTotal on July 25, 2026 referenced a rogue ScreenConnect client identifier later linked to the SCKit investigation, suggesting infrastructure associated with the campaign may have existed months before the current attacks were disclosed, although the relationship between the July sample and the November intrusions has not been confirmed.

ConnectWise noted that disabling affected extensions or rotating credentials does not remove unauthorized software, persistence mechanisms, or access that may already exist on compromised systems. Organizations may need to investigate managed endpoints for evidence of follow-on activity.

Analysis

The organizations with the greatest exposure are those operating cloud-hosted or internet-facing ScreenConnect instances with one or more affected RMM+ family extensions installed. Researchers noted that many RMM+ deployments appeared to be legitimate installations that remained enabled long after their original purpose had ended.

Where an affected extension was exposed, a threat actor could gain access to remote administration capabilities normally available to technicians and use them to manage systems through the ScreenConnect platform.

ScreenConnect is an attractive target because a single management panel can provide SYSTEM-level command execution across numerous client environments, and its activity often resembles legitimate operational work.

Researchers observed command execution records tied to the RMM+ extension rather than technician account logins, reducing visibility into unauthorized activity. Rogue ScreenConnect clients also provide a secondary access path that may survive extension removal, credential rotation, or remediation of the original intrusion vector, and researchers reported compromised hosts being reinfected shortly after being returned to service.

The confirmed impact currently includes deployment of rogue ScreenConnect clients, malware installation, persistence, and unauthorized command execution on affected systems. Researchers identified additional functionality designed to capture technician sessions and spread through trusted administrative relationships, but have not observed successful execution of that broader propagation path during incident response investigations.

This activity illustrates how supporting components attached to remote management platforms can become a pathway to widespread compromise.

Mitigations

Review every ScreenConnect instance for the presence of Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link, and verify that they are disabled. On-premises deployments require manual review and remediation. Review Run Command history, Shared Toolbox activity, extension installation records, administrative actions, and authentication logs for activity that cannot be attributed to authorized technicians. This establishes potential exposure and helps determine the scope of any unauthorized activity.

Investigate potentially affected systems using endpoint detection and response (EDR) live response, Windows Remote Management (WinRM), or another administration method separate from ScreenConnect. Researchers identified functionality designed to capture technician ScreenConnect sessions and use them to access additional managed systems. Using alternative management methods allows teams to identify and remove malware, persistence mechanisms, and unauthorized remote-access software without exposing active technician sessions to potentially compromised endpoints.

Identify indicators associated with SCKit, including unauthorized ScreenConnect client installations, the TrapWatch scheduled task, the C:\ProgramData\RelayTrap\ directory, RelayTrapLiteAlert registry entries, and known SCKit scripts. Review systems where ScreenConnect services stopped unexpectedly or new remote-access services appeared shortly afterward. These artifacts can reveal persistence that remains after the initial intrusion.

From a known-clean administrative workstation, terminate active ScreenConnect sessions, rotate ScreenConnect credentials, review browser and identity provider sessions, and validate application programming interface (API) passphrases associated with any remaining extensions. These actions help remove potentially compromised access and limit opportunities for continued use of existing sessions.

Validate that unauthorized ScreenConnect clients, scheduled tasks, registry modifications, and other persistence mechanisms have been removed before returning affected systems to service. Researchers observed instances where systems became compromised again after isolation was lifted, making remediation validation an important part of recovery efforts. A complete list of indicators of compromise (IOCs) is available in the ScreenConnect advisory .

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up