SCKit Worm Hijacks ScreenConnect Sessions to Compromise IT Technician Workstations
Written by AI from the linked story. Not reviewed by an editor. How this works
Threat actors exploited improperly secured or unpatched ConnectWise ScreenConnect instances to install unauthorized remote access clients and deploy the SCKit worm. The worm's RelayTrap component specifically targeted IT support technician sessions — a highly privileged attack surface — allowing attackers to piggyback on legitimate support workflows for lateral movement and payload distribution. This attack is particularly dangerous because it weaponizes trusted remote administration tooling, making malicious activity harder to distinguish from normal IT operations. The incident highlights how remote support infrastructure, if left misconfigured or inadequately monitored, becomes a force multiplier for attackers seeking broad, persistent access across managed environments.
Tactical Insight
Immediate actions
- Audit all active ScreenConnect instances and revoke unauthorized or unrecognized remote access clients immediately.
- Enforce allowlisting of approved remote access tools and block unauthorized agents at the endpoint and network level.
- Isolate IT technician workstations from general network segments to limit lateral movement if a session is hijacked.
Long-term improvements
- Apply the principle of least privilege to ScreenConnect session permissions, ensuring technicians only access systems relevant to their role.
- Implement MFA for all remote support tool authentication to prevent unauthorized session establishment.
- Regularly audit remote access software configurations against a hardened baseline and remove shadow or legacy installations.
Detection measures
- Deploy behavioral monitoring on remote access sessions to flag anomalous activity such as worm-like propagation or unexpected payload execution.
- Alert on new remote access client installations or ScreenConnect relay registrations that fall outside approved change management windows.
- Correlate endpoint telemetry with remote session activity to detect RelayTrap-style session hijacking patterns.