SCKit targets support technicians in ScreenConnect attacks

Researchers identified a malware toolkit called SCKit in ScreenConnect attacks that compromised at least 288 endpoints across 48 organizations, BleepingComputer reported. It attempts to spread from infected customer devices to support technicians' computers and then into other managed networks. Huntress believes initial access involved an authentication flaw in RMM+ versions 1.0.31 and 1.0.32, which could accept an empty access key. SCKit separately attempts to exploit a patched file-transfer vulnerability and steal technicians' session cookies. Huntress and Blackpoint Cyber have seen no successful worm-like spread; Blackpoint's testing found the existing ScreenConnect fix blocked execution.