SCKit Malware Exploits ScreenConnect Vulnerability

An ongoing campaign is targeting ConnectWise ScreenConnect by exploiting a critical security vulnerability that has already been patched. Blackpoint Cyber's Adversary Pursuit Group (APG) has released details about this threat, indicating the exploitation of the vulnerability CVE-2026-84869. This vulnerability has a CVSS score of 9.9, making it one of the most severe threats to the software. The malware, known as SCKit, turns support sessions into potential attack vectors for Managed Service Providers (MSPs). Attackers are leveraging the vulnerability to gain unauthorized access to systems, posing a significant risk to businesses that rely on this software.

The threat is particularly concerning as it does not target a new vulnerability but rather an already known and patched security flaw. The APG has noted that the attackers are using a specific toolkit to exploit the vulnerability. This toolkit allows them to take control of the affected systems and potentially steal sensitive data. The fact that the vulnerability has already been patched raises questions about the update policies and security awareness of the affected companies. The security flaw was addressed in September 2026 through an update from ConnectWise.

Despite the patch, many companies appear not to have transitioned to the update in a timely manner, making them vulnerable to attacks. The APG strongly recommends that all systems be updated immediately to minimize the risk of an attack. The threat posed by SCKit is not isolated. Similar attacks on remote access software have previously led to significant security incidents. Experts warn that using remote access tools without appropriate security measures is an increasing problem, especially in the current work environment where many companies rely on remote access.

The APG has also pointed out that attackers are capable of quickly adapting their tactics to circumvent new security measures. This makes it challenging for companies to protect themselves against such threats. The need for robust security protocols and regular employee training is deemed crucial to reduce the risk of attacks. The impact of a successful attack can be devastating. Companies could not only suffer financial losses but also jeopardize their reputation.

APG has emphasized that it is critical for MSPs to take proactive measures to protect their systems and ensure that all security updates are implemented promptly. The security landscape is further complicated by the increasing complexity of IT infrastructure. Many companies use a variety of software solutions that interact with each other, expanding the attack surface. The APG recommends conducting regular security audits and keeping all software solutions up to date to identify and address potential vulnerabilities. The threat from SCKit and similar malware is expected to continue to rise as attackers develop increasingly sophisticated methods.

Companies are challenged to continuously review and adjust their security strategies to address the ever-changing threats. According to Blackpoint Cyber, several companies have already fallen victim to these attacks, underscoring the urgency of the situation. The security vulnerability CVE-2026-84869 affects not only ConnectWise users but also has implications for the entire Managed Service Provider industry. The APG urges all affected companies to review their security measures and ensure they are equipped to defend against such threats.