Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes
Huntress uncovers SCKit: rogue ScreenConnect toolkit hits 288 hosts in 90 minutes.
Huntress researchers have detailed a fast-moving campaign where attackers abused cloud-hosted ScreenConnect panels to install rogue clients and a custom toolkit, SCKit, on managed endpoints. At least 288 hosts across 48 organizations were affected within 90 minutes on November 11th.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ScreenConnect?
Get an email when a new story names ScreenConnect, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.