The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged.
Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an improper privilege management and missing authorization vulnerability that could allow an attacker to file transfer and execute through an active remote session without authorization or host confirmation.
The cybersecurity company confirmed that testing against a fully patched ScreenConnect client successfully prevents execution of the exploit's payload.
"Our testing confirmed that the exploit targets CVE-2026-84869 and that the existing patch successfully blocks it," APG researchers Sam Decker and Nevan Beal said. "That's an important finding for security teams."
"But the toolkit also includes capabilities to hijack authenticated operator sessions and use legitimate ScreenConnect management features to push malicious code. Patching addresses the known exploit, but it doesn't eliminate the risks associated with a compromised operator session."
Notably, the SCKit malware contains functionality called RelayTrap to reverse-pivot to infect the workstations of technicians who attempt to investigate suspicious activity in a managed endpoint. In other words, the activity abuses trusted functionality and does not rely on a software vulnerability once an attacker obtains a valid session.
The attack sequence makes use of the platform's built-in Run Command functionality to execute commands. This involves first checking for an existing ScreenConnect installation before downloading and running an attacker-controlled MSI installer ("sc.msi"), which then delivers the batch script dropper ("sckit-run.bat").
The batch script dropper subsequently contacts "ns.mo7sen[.]dev" to fetch a PowerShell decoder ("sckit-decoder.ps1") and ultimately deploy various components associated with the SCKit toolkit.
This includes a PowerShell script ("SilentForceInstall-WithUninstall.ps1") used to establish persistent remote access by deploying two unauthorized ScreenConnect Access clients, along with a set of scripts and C# code designed to interfere with existing ScreenConnect Guest sessions, including RelayTrap.
The component attempts a guest-to-host file execution technique associated with CVE-2026-84869 by replacing the legitimate ScreenConnect Guest and sending the SCKit payload back toward the connecting technician for execution.
If this action is successful, the malware tries to recover the technician's authenticated ScreenConnect browser sessions and leverage their existing management permissions to distribute commands across additional endpoints they have access to. As a result, an attacker can move beyond the original compromised system and into other customer environments through the same infrastructure used to administer them.
"Because these commands were executed through existing ScreenConnect agents, the attackers could deploy additional software under the NT AUTHORITY\SYSTEM context without needing to establish a separate execution method on each machine," Blackpoint Cyber said.
"The unauthorized Access clients provide attackers with persistent control over the endpoint, while the RelayTrap components position the malware to intercept legitimate support connections. Rather than simply preventing administrators from accessing an infected machine, the toolkit attempts to use their next connection as an opportunity to extend the intrusion directly to the technician's workstation."
The end goal of the attack appears to target technicians, as they regularly connect to managed endpoints belonging to different customers, typically from workstations with access to administrative tools and authenticated management sessions. This enables the attackers to break out of the original endpoint and move the intrusion into an environment with potentially broader access and privileges.
Once the malware gets executed on the technician's machine, it shifts from remote support manipulation to session theft, searching the local browser data and process memory of the machine to recover an existing authenticated management session (i.e., .ASPXAUTH cookies) that can be used to propagate the malware to other endpoints without having to obtain their credentials.
"By first attempting to compromise a technician's workstation, then recover their authenticated ScreenConnect session, SCKit seeks to turn access to a single managed endpoint into an opportunity to reach other systems under that technician's control," the researchers said.
The Hacker News has contacted ConnectWise for comment, and we will update the story if we hear back.
It's worth noting that CVE-2026-84869 was previously exploited in a set of attacks in which threat actors leveraged ScreenConnect to distribute a malicious four-stage Visual Basic Script (VBScript) payload to newly connected systems and ultimately serve an XMRig cryptocurrency miner.
The vulnerability was added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, requiring federal agencies to apply the fixes by September 14, 2026.
In response to the latest incident, ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments. However, Blackpoint Cyber said it found no technical link between those extensions and SCKit.
As of writing, there is no evidence that the activity has established successful propagation to a technician workstation or bypassed the vendor patch for CVE-2026-84869.
The findings reinforce the importance of patching ScreenConnect clients, and underscore the need for stronger operator-session protections, including tighter session validation and additional authentication for bulk administrative actions, Blackpoint Cyber noted.
"Organizations need to protect those sessions and put additional safeguards around high-impact administrative actions," the researchers said.
"For MSPs, the practical lesson is to investigate the management relationship, not only the endpoint. Rogue Access installations, administrative command history, technician workstations, and browser sessions all deserve attention, especially when support personnel have already connected to a suspected system."
RMM+ Authentication Flaw Found
Huntress, in an update, said it has identified a serious authentication flaw in versions 1.0.31 and 1.0.32 of RMM+, one of the five third-party ScreenConnect extensions that has already been blocked by ConnectWise.
"When an administrator had not configured an access key, the extension would accept a blank one, potentially allowing unauthorized commands to execute without going through ScreenConnect's normal authentication controls," the company said in a statement shared with The Hacker News.
RMM+ makes it possible for another tool to manage ScreenConnect sessions without a technician working through the console. It authenticates requests with a shared access key ("RMMPlus.AccessKey") stored in the extension's settings. However, in versions 1.0.31 and 1.0.32, the key defaults to a blank value.
Because RMM+ operates independently of ScreenConnect's normal user accounts, roles, and authentication controls, an attacker could potentially execute commands on the device without bypassing multi-factor authentication.
"Commands reached endpoints across several ScreenConnect instances within minutes. There was no corresponding login activity and the commands appeared in the logs reviewed linked to RMM+."
It's worth mentioning here that while the toolkit possesses capabilities to exploit CVE-2026-84869, there is no evidence to suggest that an unpatched ScreenConnect client was the initial entry point for the attack.
"At this time, initial access appears to be linked to malicious ScreenConnect extensions, although we do not have sufficient evidence to confirm this," Beal, principal MDR analyst at Blackpoint, told The Hacker News.
"Identifying patient zero would require additional forensic evidence from affected environments. Similarly, while November 11 marks the earliest publicly reported activity, we cannot rule out earlier compromises without further investigation. Our findings confirm the toolkit's capabilities but do not establish when or how the initial compromise occurred."
When contacted for comment, a ConnectWise spokesperson told The Hacker news that it's aware of reports of malicious activity affecting a limited number of ScreenConnect partners and that it's actively investigating the incident.
"While the initial access method remains unconfirmed, our initial assessment suggests the activity may involve a threat actor's abuse of independent third-party extensions installed in partner environments," the spokesperson said.
"We have disabled the identified extensions where we can take action as a precaution and are advising on-premises partners to disable them immediately. The presence of these extensions alone does not establish compromise. We encourage partners to review the precautionary guidance in the ConnectWise Trust Center, where we will provide updates as information is validated."
(The story was updated after publication to include responses and insights from ConnectWise, Blackpoint Cyber, and Huntress.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.