Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In November 2026, threat actors deployed a novel worm-like malware toolkit dubbed SCKit against managed service providers (MSPs) using the ScreenConnect remote-access platform. Attackers exploited an authentication bypass in the third-party RMM+ extension (versions 1.0.31–1.0.32) to execute commands without valid credentials or MFA, compromising at least 288 endpoints across 48 organizations within 90 minutes. SCKit installed rogue ScreenConnect clients for persistent backdoor access and deployed a component called RelayTrap—designed to hijack MSP technician workstations mid-session—and then steal authentication cookies to pivot laterally across all customer environments the technician managed.

This incident underscores the compounding risk of supply-chain trust abuse in MSP ecosystems: a single compromised customer endpoint can be weaponized to infect the MSP's own tooling and cascade across dozens of downstream organizations. The use of LLM-generated malware source code signals a maturing attacker capability that lowers the barrier to sophisticated, multi-stage toolkit development targeting critical IT management infrastructure.

Why This Matters Now

MSPs represent high-value single points of failure—one compromised technician session can expose hundreds of downstream organizations simultaneously. With SCKit demonstrating worm-like propagation through legitimate remote-support tooling, and attackers leveraging AI-assisted malware generation, the threat to MSP-managed environments is escalating rapidly heading into 2027, demanding immediate Zero Trust segmentation and egress controls around RMM platforms.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers exploited an authentication bypass in RMM+ versions 1.0.31 and 1.0.32, a third-party ScreenConnect extension, which allowed commands to be executed without valid credentials or MFA by supplying a blank access key. This enabled unauthorized Run Command execution across multiple ScreenConnect-managed environments.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's ability to move laterally across MSP-managed customer environments depended on unrestricted network reachability between management plane components and customer endpoints. By enforcing identity-aware segmentation and controlled east-west paths, CNSF would likely have reduced the blast radius from 288 endpoints across 48 organizations to a far more contained set of reachable workloads.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The reachability of the ScreenConnect management interface from unauthenticated or unrecognized network sources would likely be constrained, reducing the pool of origins from which the blank-key bypass could realistically be triggered at scale.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The scope of endpoints reachable from a single compromised management service account context would likely be reduced, as Zero Trust segmentation could constrain lateral command propagation to only workloads explicitly permitted to receive management plane traffic from that identity and segment.

Lateral Movement

Control: East-West Traffic Security

Mitigation: The ability of a compromised endpoint to initiate outbound connections back toward the technician's workstation or push traffic laterally to peer managed endpoints would likely be constrained, reducing the worm-like propagation path that RelayTrap and the Shared Toolbox abuse depended on.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Outbound beacon traffic from compromised cloud-hosted endpoints toward unrecognized external infrastructure would likely be visible and constrainable, reducing the attacker's ability to maintain persistent command and control channels from within the MSP cloud environment.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Outbound data paths from the technician's workstation or compromised endpoints carrying harvested session material toward attacker-controlled destinations would likely be constrained by egress policy, reducing the probability that stolen cookie data successfully reaches external attacker infrastructure.

Impact (Mitigations)

Had prior CNSF controls constrained management plane reachability and east-west paths, the number of customer organizations and endpoints exposed to rogue client installation and unauthorized command execution would likely have been a fraction of the 48 organizations and 288 endpoints actually reached, with impact concentrated within far tighter network boundaries.

Impact at a Glance

Affected Business Functions

  • MSP Remote Endpoint Management and Monitoring (RMM)
  • Customer IT Infrastructure Administration
  • ScreenConnect Technician Session Integrity and Authentication
  • Multi-Tenant Managed Network Security and Toolbox Operations
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

ScreenConnect session authentication cookies stolen from MSP technician web browsers, enabling session hijacking without credentials or MFA challenge. Potential exposure of managed customer endpoint inventories accessible via hijacked technician sessions. Rogue ScreenConnect access clients installed on at least 288 endpoints across 48 organizations providing persistent attacker access to managed networks. Risk of lateral spread to additional customer organizations via the Shared Toolbox feature using legitimate MSP credentials. No confirmed exfiltration of regulated data (PII, PHI, financial records) reported at time of publication, but scope of downstream customer data exposure remains unquantified given breadth of MSP access.

Recommended Actions

  • • Apply Zero Trust Segmentation (ZTMM.Network, NIST.800-53.AC-6) to enforce identity-based microsegmentation between MSP management planes and customer endpoint networks, ensuring that a single compromised ScreenConnect environment cannot issue commands across all managed organizations without per-segment policy verification.
  • • Deploy East-West Traffic Security controls (ZTMM.Network, NIST.800-53.SC-7) to monitor and restrict workload-to-workload and service-to-service traffic within and across MSP-managed environments, detecting anomalous lateral movement patterns such as SCKit's propagation via Shared Toolbox and rogue client deployment across multiple customer segments.
  • • Enforce Egress Security & Policy Enforcement (ZTMM.Data, NIST.800-53.SC-18) with FQDN-based outbound filtering to block SCKit components from downloading RelayTrap.cs and additional payloads from attacker-controlled infrastructure, and to prevent rogue ScreenConnect clients from beaconing to unauthorized external destinations.
  • • Enable Multicloud Visibility & Control (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) with centralized traffic observability across all MSP ScreenConnect environments to detect anomalous command execution patterns, such as Run Command activity with no corresponding user login events, repeated commands executed across hundreds of endpoints within minutes, and RMM+ extension activity that bypasses standard authentication flows.
  • • Leverage Cloud Native Security Fabric (CNSF) inline enforcement and real-time inspection (ZTMM.CrossCutting.Automation, NIST.800-53.SI-4) to establish behavioral baselines for MSP management plane activity and automatically flag or block authentication events using blank or null shared access keys, unauthenticated API command execution, and third-party extension interactions that deviate from established operational patterns.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image