In a significant cybersecurity breach, hackers have compromised cloud-hosted ScreenConnect panels to distribute a malicious toolkit known as SCKit to 288 devices across 48 different organizations. This attack, initially detected by security firm Huntress on November 11, 2026, occurred over a period of just 90 minutes, with a third of the devices being targeted in the first 10 minutes.
ScreenConnect Exploitation Details
The attackers used the Run command feature on the ScreenConnect panel to execute commands across numerous endpoints simultaneously. These commands executed with SYSTEM privileges, the highest level of access on Windows systems. Initially, the commands checked for an existing ScreenConnect client before downloading a malicious installer to the C:WindowsTEMP directory and installing it quietly.
Huntress is actively collaborating with ConnectWise to investigate this breach. According to reports, the affected versions are ScreenConnect 26.6.6.9747 and 26.7.6.9783. ConnectWise has stated that there is no evidence of a compromise within its own systems or any inherent flaw in ScreenConnect itself.
ConnectWise’s Response and Investigation
On the day of the breach, ConnectWise issued a public advisory identifying five external extensions that might be linked to the incident: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, and RMM+ Password Link. As a precaution, these extensions have been disabled in approximately 400 partner environments.
ConnectWise has highlighted that these extensions provide an API capable of running remote commands, which should be safeguarded by a partner-defined passphrase. However, simply having these extensions does not confirm a security breach.
The company is yet to identify the initial entry point or fully understand the scope of the attack. Organizations managing their own servers need to manually disable these extensions, as ConnectWise does not have the capability to do so remotely.
Technical Breakdown of the SCKit Toolkit
SCKit consists of 16 components, including PowerShell scripts, batch files, and configuration data. Infected systems send their Windows ID to a command server, which then provides a decryption key for a payload tailored to each specific machine, making detection via file hashes ineffective.
The scripts subsequently install another rogue ScreenConnect client, modify Microsoft Defender settings, and establish a tool named RelayTrap within C:ProgramDataRelayTrap. A scheduled task, TrapWatch, replaces the legitimate ScreenConnect client with the compromised version, maintaining the appearance of normalcy for administrators. Huntress noted that the C# code for RelayTrap appears to have been generated using an AI model.
The toolkit also targets technicians; it activates once a technician connects to an affected device, attempting to deploy a dropper on the technician’s system and capture session cookies. Despite attempts, Huntress has not observed successful propagation of this attack, but its potential underscores the need for vigilance.
This incident is not the first exploitation of ScreenConnect. Earlier reported cases included similar rogue client activities and vulnerabilities, like CVE-2026-84869, which allowed unauthorized file transfers during live sessions. ConnectWise has since patched this vulnerability.
Recommendations and Future Outlook
Both Huntress and ConnectWise advise against connecting to suspect machines via ScreenConnect, recommending alternative tools such as EDR live response or WinRM. They further advise isolating affected hosts, removing rogue components, scrutinizing command histories, and rotating credentials from secure devices.
Indicators of compromise include domains like newnewnew.gotdns[.]org and IP addresses such as 185.99.255[.]28. ConnectWise continues to investigate and will provide updates as new information emerges, underscoring the ongoing need for robust cybersecurity measures.
