SCKit: ScreenConnect Panels Abused via Blank RMM+ Access Keys to Deploy Rogue Clients and Cookie Relays to 288 Endpoints

1. Basic Information

• Article: SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints
• Source: Huntress
• Published: 2026-11-11
• Original: Huntress
• Updated: 2026-11-11T23:34:00-05:00
• Response Priority (Author's Assessment): Critical
• Rationale for Response Priority: A toolkit with SYSTEM privileges was deployed to 288 endpoints across 48 organizations in 90 minutes, providing persistent remote access and the capability to steal technician session cookies. However, successful self-propagation from an endpoint through a technician workstation to another panel has not been observed.
• Official Vulnerability Assessments: CVE-2026-127063 — CVSS 4.0: 9.3 (Critical). CVE-2026-84869 — CVSS 3.1: 9.9; ConnectWise's official severity: Important. These assessments are separate from the author's response-priority assessment above.

Related Resources

• ConnectWise Trust Center Advisory
• ConnectWise Official Disclosure CVE-2026-127063
• ScreenConnect Bulletin (CVE-2026-84869)

2. Key Takeaways

Huntress confirmed an incident where rogue clients and SCKit were deployed to 288 endpoints across 48 organizations via multiple ScreenConnect panels, consistent with operations exploiting an issue in RMM+ 1.0.31 and 1.0.32 where unset access keys accepted empty values.

• Around 17:47 UTC on November 11, 2026, 288 endpoints across 48 organizations managed by Huntress were impacted within 90 minutes, with about one-third affected in the first 10 minutes.
• RMM+ versions 1.0.31 and 1.0.32 accepted empty values when access keys were not configured, authenticating requests while bypassing ScreenConnect users, roles, and MFA. This condition of accepting empty values is explained based on Huntress's analysis. ConnectWise's official disclosure for CVE-2026-127063 describes it as "environments retaining default values for modifiable static API secrets," and the official disclosure alone does not restrict it strictly to empty values or those specific versions. The official disclosure assigns a CVSS 4.0 score of 9.3 (Critical); this official vulnerability assessment is separate from the author's response-priority assessment in this article.
• Commands reached endpoints across multiple ScreenConnect instances without corresponding login activity; the logs Huntress reviewed linked those commands to RMM+.
• Run Command distributed a rogue ScreenConnect client and a 16-file SCKit with SYSTEM privileges, establishing the TrapWatch scheduled task and RelayTrap.
• ConnectWise proactively disabled five potentially related extensions across approximately 400 partner environments. The presence of an extension does not imply compromise.
• While code capabilities exist to steal technician session cookies and spread to other panels, host logs reviewed by Huntress showed that all console takeovers failed, and successful self-propagation has not been observed.
• The official disclosure CVE-2026-84869, related to the path from endpoints to technicians, has a CVSS 3.1 score of 9.9 and an official severity of Important, and was addressed in technician client version 26.6.5 (this is a separate vulnerability from the initial access vector in RMM+).

3. Attack Flow

Deployment from Panel to Endpoint (Observed)

1. Reaches panel functionality via requests consistent with RMM+ routing that accepts unset access keys as empty values.
2. Distributes a rogue ScreenConnect installer and dropper with SYSTEM privileges via Run Command.
3. Decrypts host-specific SCKit and deploys it to C:\ProgramData\RelayTrap.
4. Configures Defender exclusions, a rogue client, and the TrapWatch scheduled task.

Redistribution Functionality from an Endpoint via a Technician Workstation to Another Panel (Success Not Observed; Code Analysis and Failure Logs)

1. Designed to transfer and execute the dropper on the technician's workstation when a technician connects to an infected endpoint.
2. Steals ScreenConnect session cookies from the browser cookie database on the technician's workstation.
3. Reuses the stolen cookies against another panel to attempt redistribution. Host logs show all console takeovers failed, and success for this path has not been observed. According to ConnectWise, ScreenConnect technician client version 26.6.5 and later blocks this spreading attempt.

4. Attacker Position and Prerequisites

• Attacker Position: A remote attacker capable of sending requests to the third-party RMM+ extension of a cloud-hosted ScreenConnect panel.

Success Conditions

• Access keys are unset in RMM+ 1.0.31 or 1.0.32.
• The panel can execute Run Command across numerous endpoints.
• Endpoints permit payload retrieval and execution with SYSTEM privileges.
• Redistribution requires a technician client to connect to an infected endpoint, permitting file transfer and execution with available sessions and privileges.

Prevention and Failure Conditions

• Disable related extensions and prohibit reinstallation (blocking the initial access vector).
• Update the ScreenConnect technician client on technician workstations to version 26.6.5 or later (ConnectWise confirmed that attempted endpoint-to-technician propagation is blocked starting from this version; updating the cloud console alone does not update technician clients).
• Avoid connecting to suspected hosts via ScreenConnect and use out-of-band tools instead (avoiding exposure of technician workstations).
• Remove and revoke rogue clients, scheduled tasks, sessions, and credentials (post-compromise containment).

5. Visibility for Victims and Administrators

• Victims: There may be no clear indication during normal operations even if a remote support client is added.
• Administrators: Visible as RMM+ commands without logins, bulk execution of Run Command, duplicate ScreenConnect services, and TrapWatch and RelayTrap directories.

6. Confirmed Impact and Success Assessment

• Initial Execution Confirmed: SYSTEM commands and SCKit deployment from panels were observed across 288 endpoints and 48 organizations. (Scope: Huntress-managed telemetry.)
• Follow-on Compromise Confirmed: Rogue clients, RelayTrap, and TrapWatch scheduled tasks were established. (Scope: Observed activity on recovered hosts.)
• Attack Attempts Observed (Success Unconfirmed): Cookie theft and relay code were identified, but transfers and execution on technician workstations and console takeovers were not observed to succeed. (Scope: Payload analysis and recovered host logs, corresponding to the redistribution path from endpoint to technician to another panel.)

Impact

• Persistent remote access with SYSTEM privileges.
• Potential theft of ScreenConnect session cookies and lateral movement to other panels.
• Bulk deployment to multiple customer endpoints via MSPs.

7. Observable Logs

• Email: None specified
• Proxy, SWG, and DNS: Retrieval of attacker installers, decoders, and host-specific toolkits.
• Endpoint and EDR: C:\Windows\TEMP\sc.msi, sckit-run.bat, C:\ProgramData\RelayTrap, TrapWatch tasks, duplicate ScreenConnect services, and Defender exclusions.
• Identity and IdP: ScreenConnect/IdP sign-in and session records, unknown locations (used for time correlation with authentication records).
• SaaS and Cloud: ScreenConnect Run Command, Toolbox, instance audits, and extension configuration changes (matching RMM+ commands without corresponding logins is performed using ScreenConnect-side operation and audit logs).
• Network: 185.99.255[.]28, newnewnew.gotdns[.]org, sc.payproofkit[.]com, cdn007-digitaldownloads[.]com, etc.

8. Investigation and Containment Playbook

• Trigger: Run Command without corresponding logins, duplicate ScreenConnect services, TrapWatch, and RelayTrap.
• Initial Checks: Determine panel instances, extension versions and key configurations, command timestamps, impacted endpoints and technicians, and technician client versions (whether 26.6.5 or later).
• Endpoint: Use out-of-band tools to preserve files and evidence of service configurations, scheduled tasks, Defender settings, and access to browser cookie databases.
• Identity/Cloud: Revoke ScreenConnect/IdP sessions, PATs, and credentials from a clean device.
• Follow-on: Expand investigations to technician workstations and reachable external panels/endpoints.
• Containment: Isolate hosts, remove rogue clients and persistence mechanisms, revoke sessions, and rebuild if necessary.
• Classification: Distinguish extension presence, command deployment, endpoint persistence, session theft, and cross-panel spread.

9. Detection Guidance

• Single Event: TrapWatch tasks, RelayTrapLiteAlert Run keys, duplicate ScreenConnect clients, and Defender exclusions.
• Time Series: Correlate panel commands, sc.msi, SCKit, TrapWatch, and technician connections.
• Hunting: Search for Run Command/Toolbox history and client IDs, attacker domains, and browser SQLite access.
• Logging Gaps: Integrate timestamps and identities from panels, endpoints, and technicians into a single timeline.
• Priority Controls: Prioritize disabling extensions, updating technician clients to version 26.6.5 or later, out-of-band response, session revocation, and enforcing RMM least privilege.

10. Facts, Inference, and Hypothesis

Facts

• Around 17:47 UTC on November 11, 2026, 288 endpoints across 48 organizations managed by Huntress were impacted within 90 minutes, with about one-third affected in the first 10 minutes.
• RMM+ versions 1.0.31 and 1.0.32 accepted empty values when access keys were not configured, authenticating requests while bypassing ScreenConnect users, roles, and MFA (the condition of accepting empty values is based on Huntress's analysis). ConnectWise's official disclosure for CVE-2026-127063 describes it as "environments retaining default values for modifiable static API secrets," and the CVSS 4.0 score is 9.3.
• Commands reached endpoints across multiple ScreenConnect instances without corresponding login activity; the logs Huntress reviewed linked those commands to RMM+.
• Run Command distributed a rogue ScreenConnect client and a 16-file SCKit with SYSTEM privileges, establishing the TrapWatch scheduled task and RelayTrap.
• ConnectWise proactively disabled five potentially related extensions across approximately 400 partner environments. The presence of an extension does not imply compromise.
• While code capabilities exist to steal technician session cookies and spread to other panels, host logs reviewed by Huntress showed that all console takeovers failed, and successful self-propagation has not been observed.
• The official disclosure CVE-2026-84869, related to the path from endpoints to technicians, has a CVSS 3.1 score of 9.9 and an official severity of Important, and was addressed in technician client version 26.6.5 (this is a separate vulnerability from the initial access vector in RMM+).

Inference

• Because bulk SYSTEM execution from panels is combined with technician credential theft capabilities, investigating infected endpoints via ScreenConnect itself may introduce additional exposure.

Hypothesis

• No additional hypotheses

11. MITRE ATT&CK Mapping

12. Unknowns and Further Investigation

• Initial credentials/network paths that reached RMM+, total impacted organization counts, actual utilization of technician cookies, and successful cross-panel propagation remain unconfirmed.

13. Impact on SOCs and Organizations

Because remote support infrastructure used by MSPs and vendors can reach multiple customers simultaneously, organizations must expand their investigation scope beyond local endpoints to include vendor panels, technician workstations, and related sessions.

14. Audience-Specific Summary

• For SOCs: Correlate Run Command/Toolbox history, duplicate clients, TrapWatch, RelayTrap, and session usage; do not connect to suspicious hosts via ScreenConnect.
• For Administrators: Disable targeted extensions, update technician clients to version 26.6.5 or later, revoke sessions from clean devices, update credentials, and perform out-of-band investigations.
• For Users: If you notice abnormal remote support notifications or unexpected connection displays, do not operate the infected device and contact your support desk immediately.