ConnectWise probes attacks on MSPs using ScreenConnect to push rogue clients

What happened

ConnectWise is investigating an active campaign against managed service providers (MSPs, companies that run IT for other businesses). Attackers used compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices. ^[3]

The Hacker News reports at least 288 endpoints across 48 organizations were targeted. The Record says researchers had spotted intrusions at nearly 50 organizations. ^[4][5]

The SCKit toolkit and the flaw

Blackpoint Cyber's Adversary Pursuit Group says the recovered attacker toolkit exploits CVE-2026-84869, a now-patched critical flaw rated CVSS 9.9, and that the campaign does not involve a new vulnerability. SecurityWeek likewise reports the attackers exploited a vulnerability in a legitimate extension to bypass ScreenConnect authentication. ^[1][6]

BleepingComputer reports the toolkit, named SCKit, is worm-like: it is designed to spread from infected customer devices to MSP technicians' computers and compromise further managed networks. ^[2]

ConnectWise's response

ConnectWise says abuse of an independent third-party tool led to the breaches. It disabled five third-party extensions in partner environments as a precaution after reports of unauthorized access. ^[4][5]

In its advisory, ConnectWise says it has no evidence that its own infrastructure was compromised or that a vulnerability in ScreenConnect software is involved, and describes its assessment as initial. Blackpoint's account, which points to a patched flaw, differs on this point. ^[4][1]

What is not yet known

The coverage does not name the attackers or the affected providers, and the full scope is unclear. The figures come from different sources and differ slightly. ^[4][5]