Rapid SCKit worm campaign abuses ScreenConnect Run Command to compromise 288 hosts in 90 minutes
Researchers at Huntress uncovered a rapid and wide-reaching campaign where attackers exploited the legitimate Run Command feature in cloud-hosted ScreenConnect panels to silently install rogue ScreenConnect clients and a custom toolkit named SCKit across at least 288 hosts in around 90 minutes on November 11. The attackers used the Run Command capability to execute SYSTEM-level commands on managed endpoints rather than direct exploitation, installing a dropper and an encrypted payload of scripts customized per host. The core SCKit component, RelayTrap, hijacks the legitimate client's relay connection to evade detection, disables the genuine client, and establishes persistence mechanisms such as scheduled tasks and security exclusions. Although code analysis revealed worm-like capabilities intended to move laterally by stealing technician session cookies through the panel's Shared Toolbox, no successful lateral movement to technician workstations was confirmed. ConnectWise issued an advisory and disabled certain third-party extensions as a precaution. Defenders are advised to review Run Command and Toolbox histories for anomalies, isolate affected systems, rotate credentials, and follow recommended remediation steps. This incident highlights the risks posed by abuse of legitimate administrative features in remote management software.
Linha do tempo
-
Rapid SCKit worm campaign abuses ScreenConnect Run Command to compromise 288 hosts in 90 minutes
ler a análise desta fonte ocultar
Researchers at Huntress uncovered a rapid and wide-reaching campaign where attackers exploited the legitimate Run Command feature in cloud-hosted ScreenConnect panels to silently install rogue ScreenConnect clients and a custom toolkit named SCKit across at least 288 hosts in around 90 minutes on November 11. The attackers used the Run Command capability to execute SYSTEM-level commands on managed endpoints rather than direct exploitation, installing a dropper and an encrypted payload of scripts customized per host. The core SCKit component, RelayTrap, hijacks the legitimate client's relay connection to evade detection, disables the genuine client, and establishes persistence mechanisms such as scheduled tasks and security exclusions. Although code analysis revealed worm-like capabilities intended to move laterally by stealing technician session cookies through the panel's Shared Toolbox, no successful lateral movement to technician workstations was confirmed. ConnectWise issued an advisory and disabled certain third-party extensions as a precaution. Defenders are advised to review Run Command and Toolbox histories for anomalies, isolate affected systems, rotate credentials, and follow recommended remediation steps. This incident highlights the risks posed by abuse of legitimate administrative features in remote management software.