SCKit Malware Abuses Patched ScreenConnect Flaw to Threaten MSP Supply Chains

A newly documented malware toolkit is turning legitimate remote support software into an attack vector, and the implications reach well beyond a single compromised endpoint. According to research shared with The Hacker News by Blackpoint Cyber's Adversary Pursuit Group (APG), the campaign targeting ConnectWise ScreenConnect deployments is not the work of a novel zero-day. Instead, attackers are exploiting a critical flaw that has already been patched — CVE-2026-84869, which carries a CVSS score of 9.9.

The distinction matters. Organizations that assume a patch advisory closes the book on a vulnerability often leave themselves exposed, and this campaign is a case study in why.

What Is SCKit?

SCKit is the name given to the recovered attacker toolkit at the center of this activity. Rather than relying on a fresh vulnerability, the toolkit weaponizes CVE-2026-84869 to gain a foothold in ScreenConnect environments. ScreenConnect — now branded as ConnectWise ScreenConnect — is widely used by managed service providers (MSPs) and IT teams to deliver remote support and administration at scale.

That positioning is what makes the campaign notable. Remote monitoring and management (RMM) tooling sits at the heart of many MSP operations, and it is precisely the kind of trusted software that security teams are reluctant to block. Attackers know this. When they can abuse a remote access platform rather than introduce their own tooling, they inherit a degree of legitimacy that helps them blend into normal administrative traffic.

Why MSPs Are the Real Target

APG's findings point to potential MSP attack paths as the campaign's most significant risk. An MSP typically holds administrative access across dozens or hundreds of client environments. If an attacker can pivot through a support session or the underlying remote access infrastructure, the blast radius expands far beyond the initially compromised host.

This is a familiar pattern in the threat landscape: compromise the service provider, inherit the customers. The SCKit campaign fits that mold, using ScreenConnect support sessions as a springboard rather than an end goal. For defenders, this means an incident on a single ScreenConnect server should trigger scrutiny of every environment that server touches.

The Patch Gap Problem

The most uncomfortable takeaway is that CVE-2026-84869 is patched. The existence of a working exploit toolkit in the wild, aimed at a fixed vulnerability, underscores how long unpatched systems remain viable targets. Internet-facing remote access software is continuously scanned, and exploitation of known flaws remains one of the most reliable initial access techniques available to attackers.

The CVSS score of 9.9 signals a flaw that, when exploited successfully, can have severe consequences with minimal prerequisites. For organizations running ScreenConnect, confirming the current patch level is not optional housekeeping — it is the primary control standing between an exposed instance and a potential supply-chain incident.

Defensive Priorities

Security teams — particularly at MSPs — should treat this campaign as a prompt to reassess their remote access posture. Practical steps include:

  • Verify patch status immediately. Confirm that all ScreenConnect instances, including self-hosted deployments, are running current versions that address CVE-2026-84869.
  • Inventory remote access tooling. You cannot protect what you have not catalogued. Maintain an accurate list of RMM and remote support platforms, including shadow deployments spun up by individual teams.
  • Harden internet-facing services. Restrict exposure where feasible, enforce strong authentication, and monitor for anomalous session activity.
  • Audit support sessions. Log and review remote sessions for unusual timing, source locations, or privilege patterns that deviate from normal administrative behavior.
  • Extend monitoring to client environments. MSPs should assume that a compromise of their own infrastructure is a potential compromise of every customer they serve.

The Bigger Picture

The SCKit campaign is a reminder that the remote access layer is a high-value target precisely because it is trusted. Attackers are not always searching for the next zero-day; frequently they are looking for the door someone forgot to lock. A patched-but-unapplied vulnerability in software that holds the keys to many networks is exactly that door.

For MSPs, the lesson is twofold: patch discipline is a supply-chain security control, and monitoring must extend across every environment your tooling can reach. The original reporting from The Hacker News provides further technical context on the toolkit and the campaign's scope.