Security researchers at Blackpoint Cyber's Adversary Pursuit Group (APG) have identified a new malware toolkit named SCKit that targets ConnectWise ScreenConnect deployments. The campaign leverages CVE-2026-84869, a previously patched critical security vulnerability with a CVSS score of 9.9. While the flaw is not new, threat actors are utilizing the recovered toolkit to turn legitimate remote support sessions into potential entry points for broader network attacks.

The SCKit malware allows attackers to exploit the remote access software to gain persistent footholds within targeted environments. By hijacking the functionality of ScreenConnect, the toolkit can facilitate unauthorized movements across a network. Blackpoint Cyber confirmed that the activity is focused on deployments where the specific patch for the identified vulnerability has not been applied, rather than through a new zero day exploit.

For IT directors and managed service providers, this activity emphasizes the ongoing risk associated with unpatched remote management tools. The transition of ScreenConnect sessions into attack paths demonstrates how legacy vulnerabilities in widely used support software can lead to significant infrastructure compromise if left unaddressed.

The BroadVision view

IT leaders must prioritize the immediate patching of remote access tools to mitigate high CVSS score vulnerabilities like CVE-2026-84869. Maintaining rigorous software lifecycle management is essential to prevent support tools from becoming security liabilities. Organizations can strengthen their defensive posture through professional managed IT services. Teams weighing what to change first can review BroadVision's managed IT services.