[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBC8qlNE9AVOMAE3ZcKvo4d2WHr4-zNZdw6OVqg1mZFw":3},{"article":4,"iocs":51,"watch_terms":63,"solutions":64,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"cf865252-bab6-45b4-b520-b12b5fba3860","SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths","sckit-malware-turns-screenconnect-support-sessions-into-potential-msp-attack-pat-0c7b19","The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an","The SCKit malware campaign targets ConnectWise ScreenConnect deployments by exploiting CVE-2026-84869, an improper privilege management vulnerability. While a patch exists for this specific flaw, the toolkit also hijacks authenticated operator sessions and uses legitimate ScreenConnect features to push malicious code, including a component called RelayTrap that targets technicians' workstations.","SCKit malware exploits ScreenConnect flaw to target MSPs and technicians.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fsckit-malware-targets-screenconnect.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh4r5n0I6Rd7yb3jS6hfXTyM5foZU5uEiCD1I2Kgth1qgf_pzohrD9jPeDesEopB6Gjo0VaQZF2XesdqU6W32eFADzI3_xhBF4026h6uGqn6eExdfS_A29SvYA3cdIJkhWmPG-k15_DdsGGcqFfWS-E3cgyKkdEQ3Sxa9gayFkkMXggVJpkeH7DoLNLZxm9\u002Fs1600\u002Fscreen.jpg","2026-11-12T13:08:28+00:00","2026-11-12T17:00:25.529227+00:00",8,[17,20,23,26],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"ConnectWise","vendor",{"name":24,"type":25},"MSI installer","technology",{"name":27,"type":25},"PowerShell","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,60],{"type":53,"value":54,"context":55},"cve","CVE-2026-84869","Improper privilege management and missing authorization vulnerability exploited by SCKit malware.",{"type":57,"value":58,"context":59},"domain","ns.mo7sen.dev","Domain used by SCKit malware to fetch PowerShell decoder.",{"type":32,"value":61,"context":62},"SCKit","Name of the malware toolkit.",[21,18],{"controls":65,"vendors":151},[66,94,122],{"slug":67,"name":68,"problem":69,"products":70},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":67,"product_name":91,"url":92,"description":93},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,106,114],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":95,"product_name":103,"url":104,"description":105},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":123,"name":124,"problem":125,"products":126},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":162},"sckit-malware-weaponizes-screenconnect-sessions-to-compromise-msp-environments","SCKit Malware Weaponizes ScreenConnect Sessions to Compromise MSP Environments","The SCKit campaign demonstrates how a single unpatched privilege escalation vulnerability (CVE-2026-84869) in a widely deployed remote support tool can open the door to full MSP compromise. Beyond the patch gap, attackers also hijack authenticated operator sessions, meaning even patched environments remain at risk if session security is weak. The RelayTrap component specifically targets technicians' workstations, turning the trusted support tool into a lateral movement vector. Because MSPs manage many downstream clients, a successful breach here creates a supply-chain-style multiplier effect, amplifying the blast radius far beyond the initial target.",[157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 6: Access Control Management (v8)","MITRE ATT&CK T1078: Valid Accounts","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":163,"MITRE ATT&CK T1078: Valid Accounts":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"CIS Control 6: Access Control Management (v8)":166,"CIS Control 7: Continuous Vulnerability Management (v8)":167},"NIS2 Article 21(2)(i) covers access control and asset management, requiring controls that would have prevented unauthorized privilege escalation and session hijacking within the ScreenConnect environment.","SCKit abuses hijacked legitimate operator sessions to blend into normal ScreenConnect activity, which is precisely the technique T1078 describes.","SI-2 requires organizations to identify, report, and correct information system flaws; a timely patch cycle for CVE-2026-84869 would have directly prevented the privilege escalation entry point.","CIS Control 6 calls for managing and enforcing strong access credentials and session controls, which would have reduced the attackers' ability to hijack authenticated operator sessions.","CIS Control 7 requires timely remediation of known vulnerabilities; applying the available patch for CVE-2026-84869 to internet-facing ScreenConnect instances would have closed the initial exploitation path."]