Attackers Turn ScreenConnect Into a Supply Chain Risk

A new malware toolkit is exploiting a patched ScreenConnect flaw, turning IT support sessions into a major supply-chain attack path for businesses.

A new attack campaign is actively targeting deployments of ConnectWise ScreenConnect, a popular remote access tool used heavily by IT support teams and Managed Service Providers (MSPs). According to a report from Blackpoint Cyber shared with The Hacker News, attackers are using a newly identified malware toolkit, dubbed SCKit, to automate their attacks. The campaign does not leverage a new, unknown vulnerability. Instead, it exploits a critical security flaw that was discovered and patched earlier this year. The continued exploitation underscores a persistent challenge in cybersecurity: even when a fix is available, unpatched systems remain a wide-open door for attackers, who are quick to weaponize known issues against organizations that are slow to update their software.

The core of the attack is an authentication bypass vulnerability in ScreenConnect. This flaw, when exploited, allows an attacker to create a new administrator account on a vulnerable server without needing any prior credentials. Once they have administrative control over the ScreenConnect server, they effectively hold the keys to the kingdom. The SCKit toolkit is designed to make this process fast and efficient, enabling attackers to quickly scan for and compromise vulnerable internet-facing servers. After gaining this initial foothold, the attackers can use the legitimate functions of ScreenConnect to access and control any endpoint computer managed by that server. This turns a trusted IT support tool into a powerful platform for deploying further malware, stealing data, or launching ransomware attacks across a victim’s entire network.

This campaign is a classic example of a supply-chain attack, a strategy that has become increasingly favored by sophisticated threat actors. By targeting MSPs, attackers can achieve a massive return on their effort. A single compromised MSP can provide a gateway into the networks of dozens or even hundreds of their downstream clients, who trust the MSP for their IT management and security. This tactic mirrors the infamous 2021 Kaseya VSA ransomware attack, where attackers compromised a single software provider to push ransomware to an estimated 1,500 of their customers. The focus on MSPs and other central management tools shows that attackers are thinking strategically, targeting choke points in the IT ecosystem to maximize their impact and bypass the individual defenses of smaller organizations.

The primary lesson for all organizations is the non-negotiable importance of timely patch management. For critical, internet-facing infrastructure like ScreenConnect, patches must be applied as soon as they are released. Businesses that rely on MSPs for their IT services should proactively confirm that their providers have patched their systems and have robust security practices in place. This incident serves as a stark reminder that your organization's security is only as strong as that of your most privileged vendors. Security teams should not only ensure their own systems are patched but also actively hunt for any signs of compromise that may have occurred before the patch was applied. As attackers continue to build toolkits for known flaws, the window of time between a patch release and active exploitation will only continue to shrink.

This campaign highlights how even patched vulnerabilities remain a threat if systems aren't updated. For IT and security teams, it demonstrates how trusted remote access tools like ScreenConnect can be weaponized, creating a significant supply-chain risk through compromised managed service providers (MSPs).

A successful attack on a company's managed service provider can lead to a complete compromise of the business's own network. This creates a severe risk of data theft, ransomware, and operational downtime, undermining the trust placed in third-party IT management.