CybersecurityUpdated 2h ago

Huntress says SCKit hid rogue clients; cookie replay failed in checked logs

The rogue copies were built to look ordinary. SCKit stopped the legitimate ScreenConnect client, put the attacker-controlled copy in its place and reused the real client’s code libraries, leaving the machine looking normal. Huntress says SCKit also carried code designed to steal a user’s session cookie and replay it against the panel to reach other customers’ systems; those attempts had failed in every recovered host log Huntress had checked so far. Huntress links the campaign to RMM+, an extension that can manage ScreenConnect sessions without someone working through the console. That is distinct from SCKit’s CVE-associated RelayTrap behavior: Blackpoint describes it as an attempt at guest-to-host execution, but its test against a current ScreenConnect Host client did not achieve reverse execution or demonstrate a patch bypass. ConnectWise says the initial access method and full scope remain under investigation.

1 publisher1 report

Coverage started 2h ago