# SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension

> On 2026-11-11 attackers used ConnectWise ScreenConnect's Run Command feature on cloud-hosted panels to silently install a rogue ScreenConnect client and the 16-file SCKit toolkit on at least 288 endpoints at 48 Huntress-protected organizations within about 90 minutes. Huntress assesses the activity as likely related to the RMM+ third-party extension (v1.0.31/1.0.32, blank access key accepted); ConnectWise has not confirmed the initial entry point and reports no flaw in ScreenConnect itself.

- **Published:** 2026-11-12T04:51:05Z
- **Last reviewed:** 2026-11-12T05:08:17.919Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5823
- **ID:** TL-2026-5823
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)
- **CVEs:** CVE-2026-84869

## Description

Huntress first observed suspicious activity across multiple ScreenConnect environments at roughly 17:47 UTC on 2026-11-11. Operators sent Run Command jobs as SYSTEM to many endpoints at once; all 288 hosts were hit in about 90 minutes, roughly one-third within the first 10 minutes. Commands reached endpoints across several ScreenConnect instances within minutes with no matching login activity, which is consistent with a path that bypasses ScreenConnect user accounts, roles and MFA. Huntress reports the activity 'seems to be related' to the RMM+ extension (versions 1.0.31 and 1.0.32), which authenticates requests with a shared access key (RMMPlus.AccessKey) and accepted an empty value when no key had been configured. ConnectWise states it found no breach of its own systems and no flaw in ScreenConnect itself, has not identified the initial entry point, and disabled five third-party extensions (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) in about 400 partner environments; on-premises partners must disable them manually. Reported ScreenConnect versions are 26.6.6.9747 and 26.7.6.9783.

Execution chain: the Run Command checks for an existing ScreenConnect client, downloads an attacker-built installer to C:\Windows\TEMP\sc.msi (served from 185.99.255.28 / newnewnew.gotdns.org) and installs it silently. It then writes a base64-encoded dropper to C:\Windows\Temp\sckit-run.bat, which fetches sckit-decoder.ps1 and a per-host keyed SCKit package; the request carries the machine UUID and the server returns the decryption key, IV and salt, so file hashes are a weak indicator. sckit-loader.ps1 decrypts and runs k<32 hex>.ps1, which extracts the toolkit to C:\ProgramData\RelayTrap. install.ps1 installs the trap and lockout policy; CWInstall_<8 hex>-c1\Installer.ps1 adds Microsoft Defender exclusions and installs a second attacker ScreenConnect client. TrapWatch.ps1 runs as SYSTEM, compiles RelayTrap.cs into a host-specific RelayTrap.exe, and creates the TrapWatch scheduled task (every 10 seconds); the legitimate ScreenConnect service is stopped, set to manual and replaced by the attacker's copy so the host looks normal to administrators. Lite-Alert.ps1 runs at logon (Run key RelayTrapLiteAlert) and monitors ScreenConnect activity with on-screen alerts disabled. SRP/AppLocker rules block execution of files pushed through ScreenConnect temp folders. Huntress noted the RelayTrap C# code appears AI-assisted.

Technician-targeting stage (reconstructed from code, not observed succeeding): when a technician connects to a compromised host, a file transfer about 2.5 seconds later retrieves Run-Lateral-Full.bat, which fetches a per-workstation kit. Panel-Lateral.ps1 and LabConfig.ps1 steal the .aspxauth session cookie (browser cookie databases read with a staged sqlite3.exe) and replay it against the panel; ToolboxRelayUploader.exe uploads WithUninstall.ps1 to the Shared Toolbox and triggers it on every reachable session, deleting the item about 60 seconds later. Console takeover failed in every host log Huntress checked and propagation was not observed to succeed. The rogue client uses participant name 'Addmin' and installer parameter c=Exploited<N>; the malware skips machines named desktop-vmc0ifs, send and sc-observation-lab and the panel sc.payproofkit.com. Some hosts reinfected shortly after isolation was lifted. This follows September 2026 Huntress reporting of worm-like rogue ScreenConnect installs; CVE-2026-84869 (CVSS 9.9, CISA KEV) is background only and is not identified as the vector for this campaign. No threat actor is named.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1543.003 Windows Service
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1027.004 Compile After Delivery
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1219 Remote Access Tools
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1570 Lateral Tool Transfer
- T1072 Software Deployment Tools
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SCKit Exploitation — ScreenConnect Run Command Drops Rogue Client and SCKit Dropper** (`TL-2026-5823-SPL-001`)

Behaviour-first detection of the SCKit Run Command execution chain (TL-2026-5823): the ScreenConnect client service spawns cmd/PowerShell/msiexec that installs sc.msi, writes sckit-run.bat, fetches sckit-decoder.ps1 or contacts attacker staging infrastructure (185.99.255.28, newnewnew.gotdns.org). Mass execution across many hosts within minutes is the campaign signature.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.001, T1059.003, T1219, T1190
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_security
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```SCKit Run Command chain: ScreenConnect client service spawns a shell or msiexec that touches sc.msi, sckit scripts, RelayTrap or attacker staging hosts```
ParentImage="*ScreenConnect.ClientService.exe"
(Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*msiexec.exe")
(CommandLine="*sc.msi*" OR CommandLine="*sckit-run.bat*" OR CommandLine="*sckit-decoder*" OR CommandLine="*sckit-loader*" OR CommandLine="*RelayTrap*" OR CommandLine="*EadF.php*" OR CommandLine="*185.99.255.28*" OR CommandLine="*newnewnew.gotdns.org*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as child_images by host, User, ParentImage
| convert ctime(first_seen) ctime(last_seen)
| sort - count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "ScreenConnect.ClientService.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "msiexec.exe")
| where ProcessCommandLine has_any ("sc.msi", "sckit-run.bat", "sckit-decoder", "sckit-loader", "RelayTrap", "EadF.php", "185.99.255.28", "newnewnew.gotdns.org")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: SCKit ScreenConnect Run Command Installs Rogue Client or SCKit Dropper
id: 3f1c8a52-7d4e-4b19-9a26-5c0e1d7b8a01
status: experimental
description: Detects the ScreenConnect client service spawning cmd, PowerShell or msiexec to run sc.msi, sckit-run.bat, sckit-decoder.ps1, RelayTrap content or attacker staging hosts, as seen in TL-2026-5823 (SCKit campaign).
references:
    - https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
    - https://www.connectwise.com/company/trust/advisories
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - attack.command_and_control
    - attack.t1219
    - attack.initial_access
    - attack.t1190
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\ScreenConnect.ClientService.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\msiexec.exe'
    selection_cmd:
        CommandLine|contains:
            - 'sc.msi'
            - 'sckit-run.bat'
            - 'sckit-decoder'
            - 'sckit-loader'
            - 'RelayTrap'
            - 'EadF.php'
            - '185.99.255.28'
            - 'newnewnew.gotdns.org'
    condition: all of selection_*
falsepositives:
    - Legitimate administrators deploying software through ScreenConnect Run Command
    - MSP tooling that legitimately names an installer sc.msi
level: high

```

**Known false positives:**

- Administrators legitimately pushing installers via ScreenConnect Run Command
- MSP onboarding scripts that stage an installer named sc.msi

**Tuning notes:** Scope ParentImage to your own ScreenConnect instance, allow-list your own installer hashes/paths and known technician accounts, and alert on more than 5 hosts per 10 minutes for mass-execution fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SCKit Exploitation — Encrypted Per-Host Payload Staging (sckit-decoder / sckit-loader / EadF.php) (locked: unlock with TL Creds)
- SCKit Post-Exploitation — Defender Exclusions and Compile-After-Delivery of RelayTrap (locked: unlock with TL Creds)
- SCKit Lateral Movement — ScreenConnect .aspxauth Session Cookie Theft and Replay (locked: unlock with TL Creds)
- SCKit Exploitation — Rogue ScreenConnect Client Silent Install (locked: unlock with TL Creds)
- SCKit Post-Exploitation — Rogue ScreenConnect Client Service Replaces Legitimate Service (locked: unlock with TL Creds)
- SCKit Lateral Movement — Shared Toolbox Tool Transfer via ToolboxRelayUploader (locked: unlock with TL Creds)
- SCKit Post-Exploitation — TrapWatch Task and RelayTrapLiteAlert Run Key Persistence (locked: unlock with TL Creds)
- SCKit C2 — Rogue ScreenConnect Relay, Panel and Staging Infrastructure Connections (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `185.99.255[.]28`
- Domain: `newnewnew[.]gotdns[.]org`
- File hash: `3c7a98f0fdb6235b8076319c74dc1085f7b349b6d750416dd0cadb07d7972ec4`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SCKit Worm: Rogue ScreenConnect Clients and Session Cookie Relays (Huntress)](https://www.huntress.com/blog/sckit-worm-rogue-screenconnect)
- [Hackers Hijack ConnectWise ScreenConnect to Deploy SCKit Malware Across 288 Devices at 48 Organizations](https://cybersecuritynews.com/connectwise-screenconnect-hijacked/)
- [ConnectWise Trust Center Advisories](https://www.connectwise.com/company/trust/advisories)
- [Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity (Huntress)](https://huntress.com/blog/rogue-screenconnect-installations)
- [Rogue ScreenConnect Clients Spread Four-Stage VBScript Worm (The Hacker News)](https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html)
- [Modified ScreenConnect Clients Used in Worm-Like Campaign (SecurityWeek)](https://www.securityweek.com/modified-screenconnect-clients-used-in-worm-like-campaign/)
- [Hackers Weaponize ScreenConnect (Cyber Security News)](https://cybersecuritynews.com/hackers-weaponize-screenconnect/)
- [ScreenConnect Vulnerability Exploited, CVE-2026-84869 (Cyber Security News)](https://cybersecuritynews.com/screenconnect-vulnerability-exploited/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5823