← Back to the boardNews
SCKit abuses ScreenConnect to deploy remote access and target technician sessions
Why it’s here: A detailed technical analysis of an active campaign abusing ScreenConnect (used by MSPs) to deploy the SCKit worm and hijack technician console sessions, bearing on cybersecurity policy and federal critical-infrastructure/MSP security concerns, and it is original specialist threat research rather than a roundup or marketing item.
Trace across the boardItem
YesterdayMicrosoft Security BlogSCKit abuses ScreenConnect to deploy remote access and target technician sessionsMicrosoft Threat Intelligence details SCKit, a worm that abuses hijacked ConnectWise ScreenConnect sessions to install unauthorized clients, persist on customer endpoints, and target technician workstations and browser-held console cookies.1 outletCyberConnectWise probes ScreenConnect breaches as worm targets managed service providers6 linked
Connected
6 links- NewsConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizationsBoth involve RMM platform, ConnectWise, ScreenConnect
- NewsRogue remote-access campaign spread through ScreenConnect add-on, researchers sayBoth involve RMM platform, ConnectWise, ScreenConnect
- NewsHackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCsBoth involve RMM platform, ConnectWise, ScreenConnect
- NewsActive ScreenConnect attacks breach MSPs, impact dozens of organizationsBoth involve ConnectWise, ScreenConnect
- NewsConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect usersBoth involve ConnectWise, ScreenConnect
- NewsHackers Deploy Malware in Fresh ScreenConnect CampaignBoth involve RMM platform, ConnectWise
About
- RMM platform
- ConnectWise
- ScreenConnect