SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5823 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SCKit Exploitation — ScreenConnect Run Command Drops Rogue Client and SCKit Dropper

Behaviour-first detection of the SCKit Run Command execution chain (TL-2026-5823): the ScreenConnect client service spawns cmd/PowerShell/msiexec that installs sc.msi, writes sckit-run.bat, fetches sckit-decoder.ps1 or contacts attacker staging infrastructure (185.99.255.28, newnewnew.gotdns.org). Mass execution across many hosts within minutes is the campaign signature.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.001, T1059.003, T1219, T1190
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
• Severity: critical
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```SCKit Run Command chain: ScreenConnect client service spawns a shell or msiexec that touches sc.msi, sckit scripts, RelayTrap or attacker staging hosts```
ParentImage="*ScreenConnect.ClientService.exe"
(Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*msiexec.exe")
(CommandLine="*sc.msi*" OR CommandLine="*sckit-run.bat*" OR CommandLine="*sckit-decoder*" OR CommandLine="*sckit-loader*" OR CommandLine="*RelayTrap*" OR CommandLine="*EadF.php*" OR CommandLine="*185.99.255.28*" OR CommandLine="*newnewnew.gotdns.org*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as child_images by host, User, ParentImage
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "ScreenConnect.ClientService.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "msiexec.exe")
| where ProcessCommandLine has_any ("sc.msi", "sckit-run.bat", "sckit-decoder", "sckit-loader", "RelayTrap", "EadF.php", "185.99.255.28", "newnewnew.gotdns.org")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: SCKit ScreenConnect Run Command Installs Rogue Client or SCKit Dropper
id: 3f1c8a52-7d4e-4b19-9a26-5c0e1d7b8a01
status: experimental
description: Detects the ScreenConnect client service spawning cmd, PowerShell or msiexec to run sc.msi, sckit-run.bat, sckit-decoder.ps1, RelayTrap content or attacker staging hosts, as seen in TL-2026-5823 (SCKit campaign).
references:
    - https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
    - https://www.connectwise.com/company/trust/advisories
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.command_and_control
    - attack.t1219
    - attack.initial_access
    - attack.t1190
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\ScreenConnect.ClientService.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\msiexec.exe'
    selection_cmd:
        CommandLine|contains:
            - 'sc.msi'
            - 'sckit-run.bat'
            - 'sckit-decoder'
            - 'sckit-loader'
            - 'RelayTrap'
            - 'EadF.php'
            - '185.99.255.28'
            - 'newnewnew.gotdns.org'
    condition: all of selection_*
falsepositives:
    - Legitimate administrators deploying software through ScreenConnect Run Command
    - MSP tooling that legitimately names an installer sc.msi
level: high

Known false positives:

• Administrators legitimately pushing installers via ScreenConnect Run Command
• MSP onboarding scripts that stage an installer named sc.msi

Tuning notes: Scope ParentImage to your own ScreenConnect instance, allow-list your own installer hashes/paths and known technician accounts, and alert on more than 5 hosts per 10 minutes for mass-execution fidelity.

• 🔒 SCKit Exploitation — Encrypted Per-Host Payload Staging (sckit-decoder / sckit-loader / EadF.php) · unlock with TL Creds
• 🔒 SCKit Post-Exploitation — Defender Exclusions and Compile-After-Delivery of RelayTrap · unlock with TL Creds
• 🔒 SCKit Lateral Movement — ScreenConnect .aspxauth Session Cookie Theft and Replay · unlock with TL Creds
• 🔒 SCKit Exploitation — Rogue ScreenConnect Client Silent Install · unlock with TL Creds
• 🔒 SCKit Post-Exploitation — Rogue ScreenConnect Client Service Replaces Legitimate Service · unlock with TL Creds
• 🔒 SCKit Lateral Movement — Shared Toolbox Tool Transfer via ToolboxRelayUploader · unlock with TL Creds
• 🔒 SCKit Post-Exploitation — TrapWatch Task and RelayTrapLiteAlert Run Key Persistence · unlock with TL Creds
• 🔒 SCKit C2 — Rogue ScreenConnect Relay, Panel and Staging Infrastructure Connections · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-5823.

Sample indicators (3 of 32)

• IP address: 185.99.255[.]28
• Domain: newnewnew[.]gotdns[.]org
• File hash: 3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

Technical analysis

Huntress first observed suspicious activity across multiple ScreenConnect environments at roughly 17:47 UTC on 2026-11-11. Operators sent Run Command jobs as SYSTEM to many endpoints at once; all 288 hosts were hit in about 90 minutes, roughly one-third within the first 10 minutes. Commands reached endpoints across several ScreenConnect instances within minutes with no matching login activity, which is consistent with a path that bypasses ScreenConnect user accounts, roles and MFA. Huntress reports the activity 'seems to be related' to the RMM+ extension (versions 1.0.31 and 1.0.32), which authenticates requests with a shared access key (RMMPlus.AccessKey) and accepted an empty value when no key had been configured. ConnectWise states it found no breach of its own systems and no flaw in ScreenConnect itself, has not identified the initial entry point, and disabled five third-party extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) in about 400 partner environments; on-premises partners must disable them manually. Reported ScreenConnect versions are 26.6.6.9747 and 26.7.6.9783.

Execution chain: the Run Command checks for an existing ScreenConnect client, downloads an attacker-built installer to C:\Windows\TEMP\sc.msi (served from 185.99.255.28 / newnewnew.gotdns.org) and installs it silently. It then writes a base64-encoded dropper to C:\Windows\Temp\sckit-run.bat, which fetches sckit-decoder.ps1 and a per-host keyed SCKit package; the request carries the machine UUID and the server returns the decryption key, IV and salt, so file hashes are a weak indicator. sckit-loader.ps1 decrypts and runs k<32 hex>.ps1, which extracts the toolkit to C:\ProgramData\RelayTrap. install.ps1 installs the trap and lockout policy; CWInstall_<8 hex>-c1\Installer.ps1 adds Microsoft Defender exclusions and installs a second attacker ScreenConnect client. TrapWatch.ps1 runs as SYSTEM, compiles RelayTrap.cs into a host-specific RelayTrap.exe, and creates the TrapWatch scheduled task (every 10 seconds); the legitimate ScreenConnect service is stopped, set to manual and replaced by the attacker's copy so the host looks normal to administrators. Lite-Alert.ps1 runs at logon (Run key RelayTrapLiteAlert) and monitors ScreenConnect activity with on-screen alerts disabled. SRP/AppLocker rules block execution of files pushed through ScreenConnect temp folders. Huntress noted the RelayTrap C# code appears AI-assisted.

Technician-targeting stage (reconstructed from code, not observed succeeding): when a technician connects to a compromised host, a file transfer about 2.5 seconds later retrieves Run-Lateral-Full.bat, which fetches a per-workstation kit. Panel-Lateral.ps1 and LabConfig.ps1 steal the .aspxauth session cookie (browser cookie databases read with a staged sqlite3.exe) and replay it against the panel; ToolboxRelayUploader.exe uploads WithUninstall.ps1 to the Shared Toolbox and triggers it on every reachable session, deleting the item about 60 seconds later. Console takeover failed in every host log Huntress checked and propagation was not observed to succeed. The rogue client uses participant name 'Addmin' and installer parameter c=Exploited<N>; the malware skips machines named desktop-vmc0ifs, send and sc-observation-lab and the panel sc.payproofkit.com. Some hosts reinfected shortly after isolation was lifted. This follows September 2026 Huntress reporting of worm-like rogue ScreenConnect installs; CVE-2026-84869 (CVSS 9.9, CISA KEV) is background only and is not identified as the vector for this campaign. No threat actor is named.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.004 Compile After Delivery; T1036 Masquerading; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1072 Software Deployment Tools

Command and Control

T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1539 Steal Web Session Cookie

Lateral Movement

T1550.004 Web Session Cookie; T1570 Lateral Tool Transfer

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• Apply the current ScreenConnect update
• Upgrade or remove RMM+ and the other ConnectWise-flagged extensions

Immediate actions

• Do not triage suspect hosts over ScreenConnect; use EDR live response, WinRM or another out-of-band tool
• Treat any workstation a technician connected to a suspect host as exposed and investigate from a clean device
• Isolate affected hosts and keep them isolated until cleanup is complete; some hosts reinfected after isolation was lifted
• Terminate ScreenConnect web sessions and revoke browser and identity-provider sessions; rotate credentials from a clean device
• Block 185.99.255.28, 155.94.150.39 and the listed domains at DNS and egress
• Review Run Command and Toolbox history and instance audit logs for jobs no one initiated

Workarounds

• Disable Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link on on-premises servers
• If an extension must remain, set a strong access key (RMMPlus.AccessKey)
• Remove persistence: rogue client service, TrapWatch task, C:\ProgramData\RelayTrap, sckit-* files in %TEMP%, RelayTrapLiteAlert Run value; verify the legitimate client first

Longer-term hardening

• Ingest ScreenConnect logs (Event ID 201 file-run events, new client services) into the SIEM
• Alert on a second ScreenConnect client service or relay not belonging to your instance
• Restrict panel and extension API exposure and enforce MFA for all technician accounts

Affected and fixed versions

• ConnectWise — ScreenConnect
  Vulnerable versions: 26.6.6.9747; 26.7.6.9783
• Third-party (ScreenConnect extension) — RMM+ / RMM Plus / Labtech Plus (incl. Password Link variants)
  Vulnerable versions: RMM+ 1.0.31; RMM+ 1.0.32

Timeline

Last updated 2026-11-12 · revalidated 1× · latest source

• 2026-09-03 ConnectWise publishes an advisory on earlier worm-like rogue ScreenConnect client activity that Huntress had investigated in a Rapid Response; CVE-2026-84869 (CVSS 9.9, file transfer without host approval) is later patched and added to CISA KEV.
• 2026-11-11 At 23:34 ET Huntress updates its analysis, identifying the RMM+ extension (v1.0.31/1.0.32, blank access key accepted) as likely related.
• 2026-11-11 At about 22:45 ConnectWise posts an advisory: no breach of its systems and no ScreenConnect flaw found, initial entry point unidentified; five third-party extensions disabled in about 400 partner environments.
• 2026-11-11 Rogue client and SCKit installed on 288 endpoints at 48 organizations in about 90 minutes, roughly one-third in the first 10 minutes.
• 2026-11-11 Huntress first observes suspicious Run Command activity across multiple ScreenConnect environments at about 17:47 UTC.
• 2026-11-12 The Hacker News reports the campaign, citing Sophos independent observation of the curl to sc.msi, msiexec silent install and locked-ioc-21/EadF.php?p=4 sequence, with three suspected compromised and two attacker-deployed ScreenConnect instance IDs.
• 2026-11-12 ConnectWise updates its advisory at about 02:45 UTC with IOCs and guidance to avoid interactive ScreenConnect sessions with suspected devices and to revoke sessions and credentials; investigation ongoing.
• 2026-11-12 Cyber Security News publishes coverage of the SCKit campaign; ConnectWise investigation remains open and console-takeover attempts are reported to have failed in every host log checked.

Update history

• 2026-11-12 — SCKit: Rogue ScreenConnect Clients Deployed Across at Least 288 Endpoints in 48 Organizations via RMM+ Extension Abuse: What changed No field escalation. Severity HIGH, exploitability ACTIVE and status ACTIVE already reflect the evidence; attribution remains unattributed/LOW. New indicators (8) Indicator values are withheld at this access level.

Sources cited

• SCKit Worm: Rogue ScreenConnect Clients and Session Cookie Relays (Huntress) Huntress · Research · 2026-11-11
• ConnectWise Trust Center Advisories connectwise.com · Vendor report · 2026-11-11
• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity (Huntress) Huntress · Research
• Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations cybersecuritynews.com · News · 2026-11-12
• Rogue ScreenConnect Clients Spread Four-Stage VBScript Worm (The Hacker News) The Hacker News · News
• Modified ScreenConnect Clients Used in Worm-Like Campaign (SecurityWeek) SecurityWeek · News
• Hackers Weaponize ScreenConnect (Cyber Security News) cybersecuritynews.com · News
• ScreenConnect Vulnerability Exploited, CVE-2026-84869 (Cyber Security News) cybersecuritynews.com · News

More in malware

• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)
• Falcon (XG / Xiàng Gē) Browser-Based C2 Framework and Antino Implant Targeting Government Webmail and Web Applications
• Qlik Sense Servers Targeted With PowerShell/Go Reverse Shells; ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Exploits Staged
• ClickFix Attacks Evolve: Malware Hidden in PNG Images and Windows Domain Controller Compromise (Huntress)

Other reports on CVE-2026-84869

• Cisco Secure FMC Exploitation (CVE-2026-20079, CVE-2026-20316) by Qilin Affiliate UAT-11988 and Sandworm-Linked UAT-11823, with ScreenConnect (CVE-2026-84869) and PaperCut (CVE-2026-81578/82078) Management-Layer Exploitation
• Threat Intelligence Snapshot Week 37 2026: FortiGate CVE-2025-25249 Exploitation (PivotC2), StyleSmuggler Magento/Adobe Commerce Zero-Day (CVE-2026-75650), BigBear 2.0 AiTM and Related Campaigns
• CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)