SCKit abuses ScreenConnect to deploy remote access and target technician sessions

Threat actors exploited improperly secured or unpatched ConnectWise ScreenConnect instances to install unauthorized remote access clients and deploy the SCKit worm. The worm's RelayTrap component specifically targeted IT support technician sessions — a highly privileged attack surface — allowing attackers to piggyback on legitimate support workflows for lateral movement and payload distribution. This attack is particularly dangerous because it weaponizes trusted remote administration tooling, making malicious activity harder to distinguish from normal IT operations. The incident highlights how remote support infrastructure, if left misconfigured or inadequately monitored, becomes a force multiplier for attackers seeking broad, persistent access across managed environments.