[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCDn_Ga3ri53UjvDMJPo6qgOWQGKgw0HsdCKKY1oOTKE":3},{"article":4,"iocs":48,"watch_terms":55,"solutions":56,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"5381219b-c98e-41ba-8e3c-fcfcf9261fdf","SCKit abuses ScreenConnect to deploy remote access and target technician sessions","sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2","SCKit abuses ScreenConnect to deploy unauthorized remote access and target technicians. Explore the attack chain, mitigations, and Microsoft Defender XDR hunting. The post SCKit abuses ScreenConnect to deploy remote access and target technician sessions appeared first on Microsoft Security Blog.","Threat actors are actively abusing ConnectWise ScreenConnect instances to deploy unauthorized remote access clients and a malicious worm named SCKit. The worm establishes persistence and deploys a component called RelayTrap to target IT support technician workstations via hijacked ScreenConnect sessions, enabling remote administration and further payload distribution.","SCKit malware abuses ScreenConnect to gain unauthorized remote access and target IT technicians.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F11\u002F13\u002Fsckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FMS_Actional-Insights_Malware-ransomware-2.jpg","2026-11-13T21:31:44+00:00","2026-11-13T22:00:10.248511+00:00",8,[17,20,23],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":19},"Microsoft Defender XDR","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52],{"type":29,"value":50,"context":51},"SCKit","Malicious worm deployed by threat actors.",{"type":29,"value":53,"context":54},"RelayTrap","Component designed to deliver a malicious payload to a connecting technician.",[21,18,24],{"controls":57,"vendors":135},[58,87,113],{"slug":59,"name":60,"problem":61,"products":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":88,"name":89,"problem":90,"products":91},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[92,100,105],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":101,"product_name":102,"url":103,"description":104},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":114,"name":115,"problem":116,"products":117},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[118,119,127],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[136],{"slug":80,"name":81,"logo_path":82,"roles":137},[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"sckit-worm-hijacks-screenconnect-sessions-to-compromise-it-technician-workstations","SCKit Worm Hijacks ScreenConnect Sessions to Compromise IT Technician Workstations","Threat actors exploited improperly secured or unpatched ConnectWise ScreenConnect instances to install unauthorized remote access clients and deploy the SCKit worm. The worm's RelayTrap component specifically targeted IT support technician sessions — a highly privileged attack surface — allowing attackers to piggyback on legitimate support workflows for lateral movement and payload distribution. This attack is particularly dangerous because it weaponizes trusted remote administration tooling, making malicious activity harder to distinguish from normal IT operations. The incident highlights how remote support infrastructure, if left misconfigured or inadequately monitored, becomes a force multiplier for attackers seeking broad, persistent access across managed environments.",[144,145,146,147,148],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 AC-17: Remote Access","MITRE ATT&CK T1219: Remote Access Software","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":150,"NIST SP 800-53 AC-17: Remote Access":151,"MITRE ATT&CK T1219: Remote Access Software":152,"CIS Control 12: Network Infrastructure Management":153,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":154},"This point requires human resources security, access control, and asset management practices that — if applied to remote support tooling — would have enforced strict controls over who can establish and interact with ScreenConnect sessions.","This control requires organizations to establish usage restrictions, configuration requirements, and monitoring for remote access methods, which would have constrained unauthorized ScreenConnect relay use and session hijacking.","SCKit abused ScreenConnect as a living-off-the-land remote access tool, which this technique specifically covers — detecting and controlling adversary use of legitimate remote administration software.","Segmenting IT technician workstations from the broader network would have limited SCKit's ability to spread laterally once a ScreenConnect session was hijacked.","Hardening and auditing ScreenConnect configurations — such as restricting which relay endpoints and access clients are permitted — would have prevented unauthorized remote access clients from being deployed through the platform."]