An ongoing campaign abusing ConnectWise ScreenConnect is leveraging an already-patched critical vulnerability rather than an unpatched zero-day, according to findings from Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details directly with The Hacker News.
The attacker toolkit, dubbed SCKit, exploits CVE-2026-84869, a flaw carrying a CVSS score of 9.9 in the remote access software. The disclosure reframes the campaign as a patch-lag problem: the vulnerability has a fix available, yet operators who have not deployed it — or who cannot verify deployment across every managed instance — remain exposed.
That distinction matters most for managed service providers. ScreenConnect's appeal to MSPs is precisely what makes it attractive to attackers: it grants broad, trusted, standing access to client environments from a single administrative console. SCKit turns that design into a repeatable pivot, allowing an intruder who secures one foothold to move between an MSP's own network and the networks of its customers, rather than having to breach each client separately.
Why support sessions are the chokepoint
According to Blackpoint, the campaign's activity unfolds inside legitimate support sessions, which makes it unusually difficult to spot. Technicians routinely connect to customer machines, execute administrative commands, and move between endpoints as part of normal service delivery — the same behaviours an attacker using stolen or abused ScreenConnect access would exhibit. Host-level monitoring alone may not distinguish the two.
That shifts the detection burden toward session-level scrutiny: reviewing who initiated connections, which clients were accessed and when, and whether a given technician's reach matches their actual role. For MSPs, per-client access boundaries and session-log review become as important as endpoint telemetry.
A patch-and-hygiene checklist
The practical response to this campaign is largely unglamorous, but well established:
- Patch promptly. Confirm that CVE-2026-84869 is remediated across every ScreenConnect instance, including staging and forgotten deployments. The flaw is patched; exposure now reflects deployment gaps, not unpatched code.
- Enforce MFA. Strong authentication on ScreenConnect administrative and connection paths raises the cost of credential-based access.
- Review session logs. Look for connections outside normal working patterns, unusual client targeting, or sessions initiated by accounts that don't correspond to active tickets.
- Constrain technician reach. Apply least-privilege scoping so that individual technicians can only reach the clients and functions their duties require, limiting the blast radius of any single compromised account.
Scope and caveats
Blackpoint's public summary does not include detailed indicators of compromise, so defenders will need to rely on behavioural detection and access review rather than signature matching for now. The story also rests on a single research disclosure about one CVE; it should be read as evidence of a specific, exploitable pattern rather than a sweeping vulnerability class.
For managed-service providers in Hong Kong and elsewhere, the underlying lesson is generic but persistent: remote access tooling concentrates trust, and concentrated trust concentrates risk. The window between a vendor shipping a fix and an operator actually deploying it is where campaigns like this live.
Verification of CVE-2026-84869 against ConnectWise's official advisory remains the next step before the finding is treated as settled.
一場正在進行、濫用 ConnectWise ScreenConnect 的攻擊活動，所利用的是一個已修補的關鍵漏洞，而非尚未修補的 zero-day；這項發現來自 Blackpoint Cyber 的 Adversary Pursuit Group（APG），該組織已將詳情直接提供予 The Hacker News。
攻擊者使用的工具包稱為 SCKit，利用的是 CVE-2026-84869，即該遠端存取軟件中一個 CVSS 評分為 9.9 的漏洞。這次披露將該攻擊活動重新定性為修補（patch）滯後問題：漏洞已有修補方案，但尚未部署修補的營運者——或無法確認所有受管實例均已部署修補的營運者——仍然暴露於風險之中。
這項區別對管理服務供應商（MSP）尤為重要。ScreenConnect 之所以吸引 MSP，正正是它吸引攻擊者的原因：它透過單一管理控制台，授予對客戶環境廣泛、受信任且持續的存取權限。SCKit 將這一設計轉化為可重複利用的跳板，讓已取得一個立足點的入侵者可以在 MSP 自身網絡與其客戶的網絡之間自由移動，而不必逐一攻破每個客戶。
為何支援會話是關鍵瓶頸
根據 Blackpoint 的說法，該攻擊活動的行動在合法的支援會話中展開，這使其格外難以察覺。技術人員在日常服務交付中，例行連接客戶電腦、執行管理命令，並在各端點之間切換——這些行為與使用被盜或被濫用的 ScreenConnect 存取權限的攻擊者所表現的行為完全一致。單靠主機層面的監控未必能分辨兩者。
這使得檢測責任轉向會話層面的審查：檢視是誰發起連接、何時存取了哪些客戶，以及某位技術人員的實際存取範圍是否與其職責相符。對 MSP 而言，按客戶劃分的存取邊界及會話日誌審查，已變得與端點遙測（telemetry）同等重要。
修補與衛生檢查清單
針對這場攻擊活動的實際應對措施大多平凡無奇，但行之有效：
- 儘快進行修補。 確認 CVE-2026-84869 已在所有 ScreenConnect 實例上完成修補，包括 staging 環境及被遺忘的部署。漏洞本身已有修補；目前的暴露反映的是部署缺口，而非未修補的代碼。
- 強制執行 MFA。 在 ScreenConnect 的管理路徑及連接路徑上實施強身分驗證，可提高基於憑證的存取成本。
- 審查會話日誌。 留意超出正常工作模式的連接、不尋常的客戶目標，或由與有效工單不相符的帳戶所發起的會話。
- 限制技術人員的存取範圍。 採用最小權限（least-privilege）範圍設定，確保個別技術人員只能存取其職責所需的客戶及功能，從而限制任何單一被入侵帳戶的影響範圍（blast radius）。
範圍與注意事項
Blackpoint 的公開摘要並未包含詳細的入侵指標（indicators of compromise），因此防禦者目前須依賴行為檢測及存取審查，而非特徵（signature）比對。此外，該報導僅基於單一研究披露中的一個 CVE；應將其視為一個具體、可被利用的模式之證據，而非涵蓋廣泛的漏洞類別。
對香港及其他地區的管理服務供應商而言，背後的教訓雖平淡卻屢經印證：遠端存取工具將信任高度集中，而集中的信任亦將風險高度集中。廠商發布修補方案與營運者真正部署之間的時間差，正是此類攻擊活動的棲身之所。
在將此發現視為定論之前，下一步仍是對照 ConnectWise 官方公告（advisory）核實 CVE-2026-84869。