SCKit Exploitation of ScreenConnect: How RelayTrap Weaponizes Active Support Sessions for Reverse Pivots

Technical Anatomy of SCKit and the RelayTrap Reverse-Pivot Architecture

Threat actors targeting Managed Service Provider (MSP) infrastructure have evolved from passive persistence to offensive reverse-traversal. Analysis from Blackpoint Cyber’s Adversary Pursuit Group (APG) reveals that the “SCKit” toolkit specifically targets ConnectWise ScreenConnect deployments. The core exploit targets CVE-2026-84869, an improper privilege management and missing authorization vulnerability evaluated at CVSS 9.9. This vulnerability allows arbitrary file transfer and payload execution within an active remote session without host-side consent.

While verification confirms that the vendor patch for CVE-2026-84869 successfully halts initial payload delivery, SCKit incorporates modular logic that circumvents standard host perimeter defenses. Rather than terminating at host access, the toolkit deploys a dedicated component called “RelayTrap.” RelayTrap actively monitors ScreenConnect Guest instances on the compromised machine to execute a reverse pivot against connecting support personnel.

When an MSP technician initiates a support session to investigate endpoint anomalies, RelayTrap intercepts the channel. It swaps the legitimate guest binaries with malicious hooks, pushing payloads back upstream to the technician workstation. If the technician endpoint runs an unpatched or permissive client configuration, the intrusion moves laterally into the management core of the MSP.

SCKit Attack Progression and RelayTrap Reverse-Pivot Execution

Lifecycle from unpatched endpoint execution to MSP operator session compromise

01 · Step 01

Initial Dropper Sequence

Executes sc.msi, triggers sckit-run.bat, and fetches PowerShell decoder from ns.mo7sen[.]dev.

02 · Step 02

Persistence Establishment

Deploys two unauthorized ScreenConnect Access clients using SilentForceInstall-WithUninstall.ps1.

03 · Step 03

RelayTrap Interception

Replaces legitimate guest binaries to direct payloads upstream during inbound technician sessions.

04 · Step 04

Session Memory Extraction

Scrapes operator browser cache and memory space to extract authenticated .ASPXAUTH session tokens.

Attack Chain Execution and Forensic Telemetry Matrix

The deployment sequence of SCKit relies on native administrative utilities and ScreenConnect’s built-in command execution infrastructure. The initial loader checks for existing installations before deploying an MSI package (sc.msi), which unpacks a staging batch script (sckit-run.bat). This script contacts external staging infrastructure at ns.mo7sen[.]dev to retrieve an obfuscated decoder (sckit-decoder.ps1).

Once initialized, the toolkit executes SilentForceInstall-WithUninstall.ps1 to configure two independent, unauthorized ScreenConnect Access instances. Running under the NT AUTHORITY\SYSTEM context, these instances provide high-privilege redundancy that survives reboots and bypasses host-level user visibility. The toolkit then introduces compiled C# modules and scripts designed to manipulate active session pipelines.

Stage	Binary / Script Artifact	Execution Mechanism	Telemetry & Forensic Indicator
Stage 1: Staging	sc.msi, sckit-run.bat	Built-in Run Command / MSIExec	Process creation under ScreenConnect agent directory
Stage 2: Decoding	sckit-decoder.ps1	PowerShell Core invocation	DNS query to ns.mo7sen[.]dev, encoded memory buffers
Stage 3: Persistence	SilentForceInstall-WithUninstall.ps1	Background service registration	Dual rogue ScreenConnect instances, anomalous GUID registrations
Stage 4: Interception	RelayTrap (.cs / embedded scripts)	Memory hook on ScreenConnect Guest	Unauthorized file write attempts targeting technician host IP
Stage 5: Session Theft	Browser cache & memory scraper	Process memory scanning (LSASS / Browsers)	Memory handle acquisition targeting Chromium/Firefox .ASPXAUTH tokens

The critical escalation point occurs after successful reverse transmission. If the payload executes on the technician machine, SCKit abandons remote access tooling and shifts to credential and session discovery. It interrogates browser process memory and local profile databases, targeting .ASPXAUTH authentication cookies. Because these cookies represent active, pre-authenticated operator sessions, possessing them allows attackers to issue administrative commands across any customer tenant associated with that technician account without re-entering credentials.

Direct Host Compromise vs. Reverse-Pivot Session Extraction

Structural comparison between standard endpoint intrusions and RelayTrap upstream traversal

Isolated Blast Radius

Standard Host Intrusion

• • Intrusion remains confined to the compromised customer tenant
• • Privilege escalation is limited to local NT AUTHORITY\SYSTEM permissions
• • Remediation involves isolating and re-imaging a single host

Multi-Tenant Threat

RelayTrap Reverse Pivot

• • Intercepts trusted support connection to cross tenant isolation boundaries
• • Harvests .ASPXAUTH tokens to command the centralized MSP portal
• • Enables unauthenticated command fan-out to all downstream customer nodes

Verdict ·Session theft invalidates local endpoint isolation by targeting the control plane of the MSP.

Supply Chain Impact: The Mechanics of Blast Radius Amplification

The primary objective of SCKit is the exploitation of trust hierarchies inherent to managed service architectures. Support engineers operate from centralized workstations with persistent browser sessions into Remote Monitoring and Management (RMM) platforms. Gaining administrative execution on an individual client endpoint yields limited financial return. Conversely, turning that endpoint into an upstream exploitation conduit compromises the entire multi-tenant registry.

Remediation Framework for ScreenConnect Upstream Infiltration

Countermeasures against reverse-pivot exploits and persistent session re-use

01 · Exposure

Session Trust Asymmetry

Technicians connect to compromised endpoints with unsegmented management workstations.

02 · Mechanism

Memory Token Persistence

Stolen .ASPXAUTH cookies allow platform-level command execution without MFA triggers.

03 · Mitigation

Ephemerality and Validation

Enforce short-lived operator sessions, dedicated sandbox jump boxes, and hardware token bindings.

Because ScreenConnect agents run natively with system-level rights, malicious commands delivered through an authentic operator session do not trigger traditional software installation alerts. Threat actors can fan out ransomware or backdoors across hundreds of secondary client organizations in minutes.

While ConnectWise responded to early telemetry by disabling five third-party extensions across partner consoles, third-party analysis confirms that SCKit does not rely on third-party extension vulnerabilities. The threat vector relies entirely on unpatched CVE-2026-84869 instances for the initial foothold, followed by the systematic abuse of built-in ScreenConnect remote management primitives once operator sessions are hijacked.

Security Engineering Directives for ScreenConnect Environments

Securing remote management infrastructure against toolkits like SCKit requires addressing both patch baselines and administrative session hygiene. Organizations operating ScreenConnect, whether on-premises or cloud-hosted, must execute the following structural defenses:

• Enforce Client-Side Patch Compliance: Confirm all ScreenConnect endpoints are upgraded past the version addressing CVE-2026-84869. The vendor patch successfully eliminates the unauthorized file-transfer primitive that RelayTrap relies on for upstream payload delivery.
• Implement Dedicated Administration Jump Boxes: Technicians must never initiate remote sessions into unknown or suspicious endpoints directly from workstations that maintain active administrative browser sessions. Support sessions must run within ephemeral, isolated virtual environments with no access to corporate credentials or persistent browser profiles.
• Revoke and Re-bind Operator Sessions: Configure the ScreenConnect server to reject static, long-lived .ASPXAUTH cookies. Re-authentication must be mandatory when issuing high-consequence administrative actions, such as global Run Command invocations or bulk script executions.
• Hunt for Persistence Artifacts: Query endpoint fleet telemetry for unauthorized MSI installations, specifically looking for execution paths involving sc.msi, sckit-run.bat, and anomalous outbound connections to ns.mo7sen[.]dev. Verify that installed ScreenConnect service GUIDs map directly to legitimate internal server instances.
• Enforce Hardware-Bound Multi-Factor Authentication: Require FIDO2/WebAuthn tokens for all operator access. Hardware-bound credentials limit the utility of extracted session cookies, preventing attackers from replaying authentication states outside of the physical token context.