According to Bleeping Computer, a novel worm-like malware toolkit identified as SCKit has been actively deployed in recent cyberattacks targeting managed service providers (MSPs). The threat actors are exploiting vulnerabilities within the ScreenConnect remote management platform to infiltrate MSP infrastructure. Once initial access is gained, the malicious software is engineered to execute a lateral movement strategy that expands the breach beyond the initial point of entry.
The primary mechanism of the SCKit toolkit involves propagating from compromised customer endpoints directly to the computers used by MSP technicians. This specific design allows the malware to leverage the elevated privileges often held by technical staff who manage multiple client networks. By infecting the technician’s workstation, the threat actors can effectively pivot from a single customer device to compromise additional managed networks under the MSP’s purview. This cascading effect significantly amplifies the scope of the attack, transforming a localized intrusion into a widespread multi-tenant compromise.
Security researchers have observed that the toolkit operates similarly to traditional worms by automating its spread across connected devices without requiring further user interaction or explicit commands from the attacker. This autonomous propagation capability poses a severe risk to MSPs, as it facilitates rapid infection cycles before detection mechanisms can isolate the affected systems. The incident underscores the critical vulnerabilities inherent in centralized remote access tools and highlights the potential for supply chain-style attacks within the managed services sector. Organizations relying on ScreenConnect are advised to review their access controls and monitor for anomalous lateral movement patterns originating from customer devices.
