SCKit Exploits ScreenConnect to Compromise MSPs and Technician Sessions

Microsoft has confirmed an active campaign, initially reported by ConnectWise on November 11, targeting cloud ScreenConnect instances belonging to managed service providers. Attackers use the legitimate remote support software to install clients connected to their own infrastructure and distribute the SCKit worm across customer-managed endpoints. The chain includes a batch launcher, a PowerShell decoder, and device-specific cryptographic material, while persistence is achieved through scheduled tasks and registry Run keys. A component named RelayTrap is designed to target technician sessions, creating the risk that a single MSP compromise could spread to the environments of numerous customers. Affected organizations should investigate anomalous ScreenConnect access and commands, unauthorized remote clients, suspicious persistence, and the indicators published by Microsoft and ConnectWise.

Source: Microsoft Security Blog