The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged.
Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an improper privilege management and missing authorization vulnerability that could allow an attacker to file transfer and execute through an active remote session without authorization or host confirmation.
The cybersecurity company confirmed that testing against a fully patched ScreenConnect client successfully prevents execution of the exploit's payload.
"Our testing confirmed that the exploit targets CVE-2026-84869 and that the existing patch successfully blocks it," APG researchers Sam Decker and Nevan Beal said. "That's an important finding for security teams."
"But the toolkit also includes capabilities to hijack authenticated operator sessions and use legitimate ScreenConnect management features to push malicious code. Patching addresses the known exploit, but it doesn't eliminate the risks associated with a compromised operator session."
Notably, the SCKit malware contains functionality called RelayTrap to reverse-pivot to infect the workstations of technicians who attempt to investigate suspicious activity in a managed endpoint. In other words, the activity abuses trusted functionality and does not rely on a software vulnerability once an attacker obtains a valid session.
The attack sequence makes use of the platform's built-in Run Command functionality to execute commands. bat").
Source link
