ScreenConnect RCE exploited to deploy SCKit malware

What Happened

A campaign tracked as SCKit is targeting ConnectWise ScreenConnect deployments, and researchers have confirmed the intrusion vector is exploitation of a now-patched critical flaw rather than a new vulnerability. The bug, tracked as CVE-2026-84869, allows remote code execution on ScreenConnect client installations and has been observed being exploited in the wild. SCKit is the payload family delivered post-exploitation, and its design is tailored to hijack the very support-session functionality that makes ScreenConnect valuable to managed service providers.

The distinction matters. Initial reporting circulated with speculation about a fresh zero-day in the remote monitoring and management (RMM) tool. Follow-up analysis attributes the activity to opportunistic abuse of the patched RCE, meaning unpatched or internet-exposed instances remain the primary exposure.

Why It Matters

ScreenConnect is a trusted, signed, routinely allow-listed remote access tool deployed across thousands of MSP environments. An attacker who lands inside a ScreenConnect session inherits that trust: endpoint detection tools, firewalls, and users treat the session as legitimate administrative traffic. When the compromised instance belongs to an MSP, the same session can become a pivot into every downstream tenant that provider services. This is the supply-chain risk model that made incidents like the Kaseya VSA and SolarWinds compromises so damaging, scaled down to a single exposed support server.

Technical Details

The attack chain follows a consistent pattern:

• Initial access: Exploitation of CVE-2026-84869 against a vulnerable ScreenConnect client, granting code execution in the context of the ScreenConnect service.
• Payload delivery: SCKit is staged onto the host, blending with ScreenConnect’s own binaries and session artifacts to reduce static-detection signatures.
• Session abuse: The malware rides established support channels, enabling remote command execution, file transfer, and persistent access that appears to operators as normal technician activity.
• Lateral movement: From a provider instance, attackers can enumerate managed endpoints and reuse trusted remote-session paths to reach client networks.

Key indicators include unexpected ScreenConnect child processes spawning command shells, new or modified ScreenConnect service binaries, and outbound connections from support servers to unfamiliar infrastructure during off-hours.

Immediate Risk

Severity is rated critical. Any ScreenConnect instance that was internet-facing and unpatched during the exposure window should be treated as potentially compromised. MSPs face elevated risk because a single foothold can cascade to all client environments. Organizations should inventory ScreenConnect versions, confirm the patch for CVE-2026-84869 is applied, and audit active sessions for anomalous hosts. Where compromise is suspected, rotate ScreenConnect credentials and API keys immediately.

Security Insight

The non-obvious lesson here is architectural: RMM tools should be treated as tier-zero assets, equivalent to domain controllers, not as convenience utilities managed by a help-desk team. Most organizations scope their ScreenConnect servers outside privileged-access reviews, which is precisely why SCKit can hide in plain sight - the trust model assumes the tool itself is benign. Defenders should baseline expected ScreenConnect process behavior per host and alert on deviations, because in a session-hijack scenario the malicious activity will arrive wearing the tool’s own signature.

Further Reading

• ScreenConnect client RCE actively exploited (CVE-2026-84869)
• Latest Security News
• CVE Advisories
• Data Breach Reports