CriticalActive attack · 2026-11-12

ScreenConnect RMM+ extension: blank access key let attackers push the SCKit worm to 288 endpoints in 90 minutes

SockAnalyst · Security+ certified analyst.

What happened

On November 11, 2026 Huntress saw an operator use the Run Command feature on multiple cloud-hosted ScreenConnect panels to push commands, as SYSTEM, to managed endpoints. Starting around 17:47 UTC (11:47 AM CT), at least 288 hosts across 48 organizations and at least 6 MSPs were hit within 90 minutes. The command installed a second, attacker-controlled ScreenConnect client and SCKit, a PowerShell/batch toolkit that adds a SYSTEM scheduled task (TrapWatch), Defender exclusions and a 'relay trap' built to steal the .aspxauth session cookie of any technician who connects and spread to their panel; Huntress says that console takeover failed in every log it checked. Huntress ties the access to RMM+, a third-party ScreenConnect extension whose versions 1.0.31 and 1.0.32 accepted a blank access key when none was configured, skipping ScreenConnect accounts, roles and MFA. ConnectWise says it found no compromise of its own infrastructure or a flaw in ScreenConnect itself, and disabled five RMM+ family extensions in about 400 partner environments. No CVE had been assigned when we checked.

Who's affected

MSPs and IT teams running ScreenConnect with any RMM+ family extension (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link) installed, especially RMM+ 1.0.31 or 1.0.32 with no access key set, plus every endpoint those panels manage and any technician workstation that connected to an affected host. Huntress says current ScreenConnect 26.6.6.9747 and 26.7.6.9783 panels were affected.

✅ Fix / patch

Disable and remove the RMM+ family extensions now (Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link, RMM+ Password Link). ConnectWise disabled them on hosted instances; on-premises partners must do it themselves and must not re-enable them pending further guidance.
Do NOT connect to a suspected host through ScreenConnect: the trap targets the connecting technician. Use EDR live response, WinRM or another out-of-band tool, and treat any technician workstation that already connected as exposed.
From a clean device, revoke all ScreenConnect and identity-provider sessions, reset every ScreenConnect user password, enforce MFA, remove unknown users and review extensions and the Shared Toolbox.
On affected hosts remove the rogue ScreenConnect client service, the TrapWatch scheduled task, C:\ProgramData\RelayTrap\, sckit-* files and runnew.cmd/Panel-Lateral.ps1/ToolboxRelayUploader.exe/sqlite3.exe under %TEMP%, and the RelayTrapLiteAlert Run key; verify the legitimate client separately. Keep hosts isolated until cleaned, since Huntress saw reinfection after isolation was lifted.
Block the published infrastructure at firewall and DNS and rotate credentials used or stored on affected hosts (domain admin, service, backup, hypervisor, browser-saved).

🔎 Quick hunt check

Huntress published IOCs, but warns file hashes are weak because scripts are rebuilt per host and RelayTrap.exe is compiled on each machine; hunt on behavior first. Look for mass Run Command or Toolbox activity you did not start, a second ScreenConnect client service on one host, msiexec installing C:\Windows\Temp\sc.msi, a TrapWatch scheduled task, files under C:\ProgramData\RelayTrap, the RelayTrapLiteAlert Run key, and traffic to the listed domains and IPs.

MITRE ATT&CK: T1219, T1072, T1053.005, T1547.001, T1562.001, T1539

IOCs

IP addresses: 185.99.255[.]28, 155.94.150[.]39
Domains: newnewnew.gotdns[.]org, soxnewwork.homedns[.]org, sc.payproofkit[.]com, cdn007-digitaldownloads[.]com, hxxps://ns.mo7sen[.]dev/EadF.php
Files / paths: C:\Windows\Temp\sc.msi, C:\Windows\Temp\sckit-run.bat, %TEMP%\sckit-decoder.ps1, %TEMP%\sckit-loader.ps1, C:\ProgramData\RelayTrap\, Panel-Lateral.ps1 SHA256 7a9aca9fdd4dcc13fe497cabdb13ca1e5d6a529271c8aa495e5ca1c1c80271ec, ToolboxRelayUploader.exe SHA256 8cb5f48bbe70b5248db7f327f3d1ad6649df5c767d2a7e0711ee147fd92e06af, Run-Lateral-Full.bat SHA256 43b7a5e56f9e6c7b74e1ce2b7b5af63f383084625fcc2d3a5985fa1059e2db95

From Huntress (defanged). Also: scheduled task TrapWatch, Run key RelayTrapLiteAlert, rogue client IDs 2588ef5c15954b10 and ed630cc2c873b091, attacker participant name Addmin. Huntress says hashes are weak indicators because scripts are rebuilt per host.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=wineventlog OR index=sysmon OR index=edr) ((EventCode=1 OR EventCode=4688) (CommandLine="*\\Temp\\sc.msi*" OR CommandLine="*sckit-*" OR CommandLine="*RelayTrap*" OR CommandLine="*TrapWatch*" OR CommandLine="*EadF.php*" OR CommandLine="*runnew.cmd*" OR CommandLine="*Panel-Lateral*" OR CommandLine="*ToolboxRelayUploader*")) OR (EventCode=11 (TargetFilename="C:\\ProgramData\\RelayTrap\\*" OR TargetFilename="*\\sckit-*")) OR (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\RelayTrapLiteAlert") OR (EventCode=4698 TaskName="*TrapWatch*") OR (EventCode=7045 ServiceName="ScreenConnect Client (*")
| stats count min(_time) as first_seen values(CommandLine) as cmds values(TargetFilename) as files values(ServiceName) as services by host
| append [ search (index=proxy OR index=dns OR index=firewall) (query IN ("newnewnew.gotdns.org","soxnewwork.homedns.org","sc.payproofkit.com","ns.mo7sen.dev","cdn007-digitaldownloads.com") OR url="*ns.mo7sen.dev/EadF.php*" OR dest_ip IN ("185.99.255.28","155.94.150.39")) | stats count min(_time) as first_seen by src_ip, dest_ip, query, url ]
// ScreenConnect RMM+ / SCKit: rogue client install, RelayTrap persistence, Huntress-listed infrastructure

let ScC2Domains = dynamic(["newnewnew.gotdns.org","soxnewwork.homedns.org","sc.payproofkit.com","ns.mo7sen.dev","cdn007-digitaldownloads.com"]);
let ScC2IPs = dynamic(["185.99.255.28","155.94.150.39"]);
union
(DeviceProcessEvents
 | where Timestamp > ago(14d)
 | where ProcessCommandLine has_any ("\\Temp\\sc.msi", "sckit-", "RelayTrap", "TrapWatch", "EadF.php", "runnew.cmd", "Panel-Lateral", "ToolboxRelayUploader")
 | project Timestamp, DeviceName, Detail=ProcessCommandLine, Parent=InitiatingProcessFileName),
(DeviceFileEvents
 | where Timestamp > ago(14d)
 | where FolderPath startswith @"C:\ProgramData\RelayTrap" or FileName startswith "sckit-"
 | project Timestamp, DeviceName, Detail=FolderPath, Parent=InitiatingProcessFileName),
(DeviceRegistryEvents
 | where Timestamp > ago(14d)
 | where RegistryKey has @"CurrentVersion\Run" and RegistryValueName == "RelayTrapLiteAlert"
 | project Timestamp, DeviceName, Detail=RegistryValueData, Parent=InitiatingProcessFileName),
(DeviceNetworkEvents
 | where Timestamp > ago(14d)
 | where RemoteUrl has_any (ScC2Domains) or RemoteIP in (ScC2IPs)
 | project Timestamp, DeviceName, Detail=strcat(RemoteUrl, " ", RemoteIP), Parent=InitiatingProcessFileName)
// ScreenConnect RMM+ / SCKit worm hunt (Huntress IOCs + behavior)

See all hunt queries →

⏱ CISA deadline

Not in CISA KEV as of Nov 14, 2026.

Sources

Related playbooks

Barracuda ESG: pre-auth admin bypass chained to root command injection, now exploited · Exploited vuln · 2026-11-10
N-able N-central "Able2Shell": 33 public zero-days with PoCs, hosted service taken offline and on-prem servers told to shut down · Exploit · 2026-11-10
APT29 watering holes hit unpatched iOS/Android; CISA adds Apple CVE-2024-27834 to KEV · Exploited vuln · 2026-11-04

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →