[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv5fDVDEiLF80riuKzAgG_sWdNsCZOMTzTz3jdqofPFs":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"efa7c37a-0a0c-40c6-87e7-e2a3e2379eec","New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks","new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks-afe79e","A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks. [...]","A new worm-like malware toolkit named SCKit has been observed in recent ScreenConnect attacks targeting managed service providers (MSPs). The malware is designed to spread from infected customer devices to MSP technicians' computers, potentially compromising additional managed networks. Researchers noted that while SCKit attempts to exploit a patched ScreenConnect vulnerability (CVE-2026-84869), exploitation of this specific flaw was not observed, with the exploit failing in testing. The initial access is believed to have been through an authentication flaw in the RMM+ ScreenConnect extension.","New SCKit malware targets MSPs via ScreenConnect attacks, exploiting a vulnerability to spread.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F16\u002FScreenConnect-headpic.jpg","2026-11-12T22:53:10+00:00","2026-11-12T23:00:10.184203+00:00",8,[17,20,23],{"name":18,"type":19},"ScreenConnect","product",{"name":21,"type":22},"RMM+","technology",{"name":24,"type":25},"ConnectWise","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"cve","CVE-2026-84869","ScreenConnect vulnerability exploited by SCKit",[24,18],{"controls":56,"vendors":144},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":116,"name":117,"problem":118,"products":119},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[145],{"slug":79,"name":80,"logo_path":81,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"sckit-worm-exploits-msp-remote-tools-via-authentication-flaw","SCKit Worm Exploits MSP Remote Tools via Authentication Flaw","A worm-like malware toolkit called SCKit is targeting managed service providers by exploiting an authentication vulnerability in the RMM+ ScreenConnect extension, designed to spread laterally from compromised customer environments to MSP technician machines and beyond. Because MSPs hold privileged access to dozens or hundreds of client networks, a single compromised technician workstation can cascade into a multi-organization breach. The initial foothold came not from the patched CVE but from an unmitigated authentication flaw in a third-party extension, highlighting that patching the core product is insufficient if ancillary components remain vulnerable. This incident underscores the disproportionate risk posed by trusted remote management tools when access controls and patch hygiene are not applied comprehensively across all integrated components.",[153,154,155,156,157],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(i)","MITRE ATT&CK T0867: Lateral Tool Transfer",{"NIS2 Article 21(2)(i)":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"MITRE ATT&CK T0867: Lateral Tool Transfer":161,"CIS Control 12: Network Infrastructure Management (v8)":162,"CIS Control 7: Continuous Vulnerability Management (v8)":163},"This point mandates access control and asset management practices, and stronger authentication controls on MSP remote management tools would have blocked the initial authentication-flaw-based intrusion vector.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner — explicit coverage of third-party extensions under this control would have driven patching of the vulnerable RMM+ authentication component.","SCKit's worm-like behavior — propagating from customer devices to technician machines via the ScreenConnect session — directly maps to lateral tool transfer, and detecting this technique would have limited the blast radius of the compromise.","CIS Control 12 calls for segmenting and controlling network access paths, which would have prevented the worm from spreading laterally from compromised customer devices to MSP technician machines.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities across all software components, including third-party extensions — applying this to the RMM+ plugin would have surfaced the authentication flaw before attackers exploited it."]