The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged.
Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an improper privilege management and missing authorization vulnerability that could allow an attacker to file transfer and execute through an active remote session without authorization or host confirmation.
The cybersecurity company confirmed that testing against a fully patched ScreenConnect client successfully prevents execution of the exploit's payload.
"Our testing confirmed that the exploit targets CVE-2026-84869 and that the existing patch successfully blocks it," APG researchers Sam Decker and Nevan Beal said. "That's an important finding for security teams."
"But the toolkit also includes capabilities to hijack authenticated operator sessions and use legitimate ScreenConnect management features to push malicious code. Patching addresses the known exploit, but it doesn't eliminate the risks associated with a compromised operator session."
Notably, the SCKit malware contains functionality called RelayTrap to reverse-pivot to infect the workstations of technicians who attempt to investigate suspicious activity in a managed endpoint. In other words, the activity abuses trusted functionality and does not rely on a software vulnerability once an attacker obtains a valid session.
The attack sequence makes use of the platform's built-in Run Command functionality to execute commands. This involves first checking for an existing ScreenConnect installation before downloading and running an attacker-controlled MSI installer ("sc.msi"), which then delivers the batch script dropper ("sckit-run.bat").
The batch script dropper subsequently contacts "ns.mo7sen[.]dev" to fetch a PowerShell decoder ("sckit-decoder.ps1") and ultimately deploy various components associated with the SCKit toolkit.
This includes a PowerShell script ("SilentForceInstall-WithUninstall.ps1") used to establish persistent remote access by deploying two unauthorized ScreenConnect Access clients, along with a set of scripts and C# code designed to interfere with existing ScreenConnect Guest sessions, including RelayTrap.
The component attempts a guest-to-host file execution technique associated with CVE-2026-84869 by replacing the legitimate ScreenConnect Guest and sending the SCKit payload back toward the connecting technician for execution.
If this action is successful, the malware tries to recover the technician's authenticated ScreenConnect browser sessions and leverage their existing management permissions to distribute commands across additional endpoints they have access to. As a result, an attacker can move beyond the original compromised system and into other customer environments through the same infrastructure used to administer them.
"Because these commands were executed through existing ScreenConnect agents, the attackers could deploy additional software under the NT AUTHORITY\SYSTEM context without needing to establish a separate execution method on each machine," Blackpoint Cyber said.
"The unauthorized Access clients provide attackers with persistent control over the endpoint, while the RelayTrap components position the malware to intercept legitimate support connections. Rather than simply preventing administrators from accessing an infected machine, the toolkit attempts to use their next connection as an opportunity to extend the intrusion directly to the technician's workstation."
The end goal of the attack appears to target technicians, as they regularly connect to managed endpoints belonging to different customers, typically from workstations with access to administrative tools and authenticated management sessions. This enables the attackers to break out of the original endpoint and move the intrusion into an environment with potentially broader access and privileges.
Once the malware gets executed on the technician's machine, it shifts from remote support manipulation to session theft, searching the local browser data and process memory of the machine to recover an existing authenticated management session (i.e., .ASPXAUTH cookies) that can be used to propagate the malware to other endpoints without having to obtain their credentials.
"By first attempting to compromise a technician's workstation, then recover their authenticated ScreenConnect session, SCKit seeks to turn access to a single managed endpoint into an opportunity to reach other systems under that technician's control," the researchers said.
The Hacker News has contacted ConnectWise for comment, and we will update the story if we hear back.
It's worth noting that CVE-2026-84869 was previously exploited in a set of attacks in which threat actors leveraged ScreenConnect to distribute a malicious four-stage Visual Basic Script (VBScript) payload to newly connected systems and ultimately serve an XMRig cryptocurrency miner.
The vulnerability was added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, requiring federal agencies to apply the fixes by September 14, 2026.
In response to the latest incident, ConnectWise has taken the precautionary step of disabling five third-party extensions in partner environments. However, Blackpoint Cyber said it found no technical link between those extensions and SCKit.
As of writing, there is no evidence that the activity has established successful propagation to a technician workstation or bypassed the vendor patch for CVE-2026-84869.
The findings reinforce the importance of patching ScreenConnect clients, and underscore the need for stronger operator-session protections, including tighter session validation and additional authentication for bulk administrative actions, Blackpoint Cyber noted.
"Organizations need to protect those sessions and put additional safeguards around high-impact administrative actions," the researchers said.
"For MSPs, the practical lesson is to investigate the management relationship, not only the endpoint. Rogue Access installations, administrative command history, technician workstations, and browser sessions all deserve attention, especially when support personnel have already connected to a suspected system."
