An active campaign against ConnectWise ScreenConnect has hit managed service providers, The Hacker News and SecurityWeek report. Here’s what’s known so far:
- ConnectWise disabled five third-party extensions as a precaution in about 400 partner environments. It says there’s no sign its own infrastructure or ScreenConnect itself was compromised, and it’s asked on-prem partners to disable the extensions too.
- Blackpoint Cyber says the toolkit, SCKit, exploits CVE-2026-84869 (9.9), a known, already-patched bug that allows file transfer and execution in a live session. Fully patched clients block it.
- SCKit can also hijack logged-in operator sessions and use ScreenConnect’s own Run Command to push installers and add rogue access clients. Its RelayTrap module goes after technicians who investigate the endpoint.
What to do
Patch ScreenConnect, disable the flagged extensions, and check for new admin accounts, unexpected extension installs, Toolbox activity and unapproved remote-access clients. Hang on to your logs.
My take
Patching stops the exploit, but it won’t save you from a stolen operator session. Remote-access tools need phishing-resistant MFA and tight admin lists, because whoever controls them controls everything they manage.
God Bless, and May the Source Be with You!
