Worm-Like 'SCKit' Toolkit Used in ScreenConnect Attacks on MSPs

What Happened

According to BleepingComputer, a new worm-like malware toolkit named SCKit was deployed in recent ScreenConnect attacks targeting managed service providers (MSPs). The report says the toolkit is designed to spread from infected customer devices to MSP technician computers, and from there into other managed networks.

Details are still emerging. Attribution, the initial access method, and the full scope of affected organizations have not been confirmed in the source report.

Why It Matters for Defenders

MSPs sit at a high-leverage point in the supply chain. A single compromised technician machine or remote session can provide a path into many customer environments. A self-propagating toolkit that targets the MSP-to-customer trust relationship through ScreenConnect means a single ScreenConnect compromise may not stay contained to one tenant. It can become a pivot point across an MSP's client base.

What Defenders Should Watch For

• Unexpected ScreenConnect session activity. Sessions initiated from customer endpoints toward technician workstations, or new or unapproved ScreenConnect instances on managed devices.
• Anomalous process lineage from the ScreenConnect client or service, such as spawning scripting engines, remote admin tools, or file transfer utilities it does not normally invoke.
• Credential or session reuse across MSP technician tooling. Audit how ScreenConnect credentials and instance configurations are stored and shared.
• Network pivoting indicators. Technician workstations making outbound connections to multiple unrelated customer networks in a short window, consistent with worm-like lateral spread.
• General hardening. Restrict and monitor ScreenConnect instance provisioning, enforce MFA on technician access, and segment MSP management infrastructure from customer-facing networks where possible.

These are hunting angles based on the reported behavior, not a confirmed IOC list or detection signature. Treat them as starting points pending further technical disclosure.

Developing Story

This is a recently reported campaign. Technical details such as indicators, the full infection chain, and any CVE involvement had not been fully disclosed at the time of writing. We will track this story as more information becomes available. Read the original report at BleepingComputer.