SCKit Malware Exploits ScreenConnect for Widespread Attacks

SCKit Malware Exploits ScreenConnect for Widespread Attacks

ByAftab Ahmed

Cybercriminals have leveraged ScreenConnect’s remote access platform to distribute a sophisticated malware known as SCKit, compromising at least 288 devices across 48 organizations. This alarming campaign, uncovered by cybersecurity firm Huntress on November 11, demonstrates a highly infectious worm-like propagation method that poses significant risks to managed service providers (MSPs).

How the SCKit Malware Spreads via ScreenConnect

The attackers gained control of cloud-hosted ScreenConnect panels, using the platform’s own Run Command feature to deploy malicious ScreenConnect clients on targeted systems. These rogue clients then initiated the SCKit payload, establishing persistent backdoors and harvesting browser session cookies for further exploitation.

Moreover, the malware utilizes lateral movement tactics that amplify the threat. When a technician connects to an infected endpoint through ScreenConnect, the infection spreads back to their workstation. From there, attackers can access multiple client environments managed by that technician, enabling extensive compromise across networks.

Uncovered Attack Mechanism and Industry Response

SCKit is delivered as an encrypted, Base64-encoded payload that executes PowerShell scripts to evade Microsoft Defender by adding exclusions, install attacker-controlled ScreenConnect instances, and schedule automated malicious tasks like “TrapWatch.” Uniquely, this toolkit replaces legitimate ScreenConnect installations with unauthorized versions, increasing control over affected systems.

ConnectWise, the company behind ScreenConnect, has confirmed that the breach did not stem from vulnerabilities in its platform or infrastructure. Instead, rogue third-party extensions such as Labtech Plus and RMM Plus—commonly installed in partner environments—were exploited as entry points.

In response, ConnectWise has disabled five implicated third-party extensions across partner systems to curb the spread. Security researchers at Sophos have also validated these attack patterns in their independent alerts.

Implications for Pakistan’s IT and Cybersecurity Landscape

For Pakistani MSPs and organizations relying on remote support tools like ScreenConnect, this malware campaign underlines the critical importance of monitoring third-party plugins and user endpoints for suspicious activity. Given the interconnected nature of technician-managed client networks, a single security lapse can lead to cascading breaches affecting numerous clients.

Investing in enhanced cybersecurity defences and adopting strict extension vetting processes can mitigate potential exploitation risks. As cyber threats evolve in complexity, vigilant oversight and rapid incident response remain vital for safeguarding digital infrastructures, particularly in emerging technology markets such as Pakistan.

According to Huntress, this attack represents a two-stage breach process, moving from infected endpoints to technicians and then propagating to all endpoints accessed by those technicians, amplifying its destructive potential.

Related Stories

Similar Posts