The latest cybersecurity threat involves the exploitation of a fixed security flaw in ConnectWise’s ScreenConnect, a remote access tool previously affected by a critical vulnerability. This development highlights ongoing risks for Managed Service Providers (MSPs) as attackers use the vulnerability to infiltrate systems.
Exploiting CVE-2026-84869
Blackpoint Cyber’s Adversary Pursuit Group (APG) has revealed that the attacker toolkit exploits CVE-2026-84869. This flaw, which scores 9.9 on the CVSS scale, pertains to improper privilege management and missing authorization, enabling unauthorized file transfers and execution via active remote sessions. Although patched versions of ScreenConnect block this exploit, the toolkit also hijacks authenticated operator sessions, leveraging legitimate features to deploy malicious code.
The SCKit malware toolkit, featuring a function named RelayTrap, targets technician workstations investigating suspicious activities. By abusing the platform’s Run Command feature, attackers can execute commands, downloading an MSI installer and executing a batch script that retrieves various malicious components.
Malware Deployment and Tactics
Once the batch script is executed, it contacts external servers to download additional scripts and components, including a PowerShell script for persistent remote access. This script installs unauthorized ScreenConnect Access clients and disrupts existing guest sessions. The attack further exploits the CVE-2026-84869 vulnerability by replacing legitimate guest components with malicious payloads.
If successful, the malware seizes authenticated ScreenConnect browser sessions, using management permissions to issue commands across other endpoints. This allows attackers to extend their reach from the initial compromised system to broader environments, leveraging the same infrastructure used for administrative tasks.
Preventive Measures and Ongoing Risks
ConnectWise has responded by disabling certain third-party extensions in partner environments. However, Blackpoint Cyber notes no direct connection between these extensions and the SCKit malware. While current reports indicate no successful propagation to technician workstations, the situation highlights the importance of stringent security measures.
Additional findings suggest an authentication flaw in the RMM+ extension, allowing unauthorized command execution without bypassing standard controls. Though there’s no evidence linking this flaw to the initial attack vector, the potential misuse underscores the need for enhanced vigilance.
Looking Forward
The ongoing situation emphasizes the critical nature of patching known vulnerabilities and securing operator sessions. MSPs must also scrutinize management relationships and administrative actions, given the potential for rogue installations and unauthorized access.
ConnectWise continues to investigate the incident, advising partners to disable specific extensions and monitor their environments. As the situation develops, organizations are encouraged to stay informed via the ConnectWise Trust Center for updated guidance and information.
