SCKit ScreenConnect Worm MSP Threat Nov 2026 | SBCSG | The Small Business Cybersecurity Guy

This is your Daily Threat Analysis for the 13th of November 2026.

Three items today. All three are actionable. None of them are abstract future risks.

SCKit: When Your IT Support Tool Becomes the Attack

On the 11th of November 2026, a worm-like toolkit called SCKit was used to compromise 288 hosts across 48 separate organisations in a single operation. The initial access vector, as of time of writing, has not been confirmed by ConnectWise. What has been confirmed is the mechanism: attackers exploited legitimate cloud-hosted ScreenConnect remote management panels to deploy attacker-controlled clients and the SCKit toolkit across victim environments.

ScreenConnect is widely used by managed service providers across the UK to remotely support client machines. That is exactly why this matters.

The attack worked in two stages. In the first, SCKit spread from compromised client endpoints outward. In the second, and this is the part that should concern anyone who relies on an external IT provider, it moved from infected endpoints to technician workstations by stealing session cookies. Once the technician workstation was compromised, the attacker inherited whatever access that technician had. On an MSP technician’s machine, that access typically extends to every client they support.

Research from both Huntress and Blackpoint Cyber documents this campaign in detail. Huntress describes SCKit as combining rogue remote access installations with a Guest-to-Host file execution technique, turning ScreenConnect’s own legitimate functionality against the organisations it is meant to serve. ConnectWise disabled five third-party extensions as a precaution following the incident, though at the time of publication had not identified the initial access vector.

The advisory on this will tell you that the vulnerability tracked as CVE-2026-84869 is relevant. What it will not tell you, with enough directness, is the supply chain implication: your MSP being compromised does not require your own systems to have done anything wrong. If the attacker is on your IT provider’s technician workstation, they are potentially on your systems by extension.

What to ask your IT provider today:

Were any of your ScreenConnect deployments among the 48 affected organisations?
Have you audited ScreenConnect session logs from the 11th of November for unauthorised access?
Are you reviewing third-party extensions installed on your ScreenConnect instance?
Have you rotated session credentials and technician access tokens since the 11th?

If they cannot answer the first question, that is itself an answer.

Luna Moth: Back at Law Firms, and They Have Stopped Using Malware

Luna Moth, also tracked as Silent Ransom Group, is an extortion group with a documented history of targeting law firms that hold sensitive client data. They have returned, and they have refined their approach.

The technique documented by ReliaQuest is worth understanding in detail because it bypasses the defence most organisations have been told will protect them.

Attackers impersonate IT support staff and contact victims via video calls. During the call, they convince the target to open their browser developer tools, navigate to Microsoft 365 Copilot, and extract Microsoft Graph access tokens. Those tokens are then handed over, willingly, by the victim, who believes they are cooperating with legitimate IT support.

Here is the problem: those tokens are valid. They are not phished credentials that might fail an MFA check. They are not stolen passwords that trigger a Conditional Access policy alert. They are live session tokens that represent an already-authenticated session. MFA has already been satisfied. Conditional Access has already been passed. The attacker walks in through the front door using a key the victim just handed them.

This is not a technical vulnerability in Microsoft’s systems. It is a procedural one. The question is not whether your Microsoft 365 tenant is configured correctly, it may well be. The question is whether your staff, particularly those in legal, would know that a legitimate IT support call would never ask them to open developer tools and copy a token.

For UK law firms, the data at risk is not abstract. Client communications, case files, matters subject to legal professional privilege, all of it sits in Microsoft 365 environments. Luna Moth’s model is exfiltration-based extortion: they take the data and threaten to publish it. They do not encrypt your files. There is no ransomware to restore from backup.

ReliaQuest notes that the group is specifically re-targeting firms that previously declined to pay. If your firm received contact from this group previously and chose not to engage, you should treat that as an elevated threat indicator right now.

Immediate steps:

Brief fee earners and support staff that no legitimate IT support call will ask them to extract tokens from browser developer tools. Full stop.
Review your Microsoft 365 Conditional Access policies to assess whether token lifetime restrictions and continuous access evaluation are configured.
Check whether Microsoft Graph activity logs show any anomalous token usage, particularly from unusual locations or devices.
If you use Microsoft 365 Copilot, assess what data it has access to and whether that access is appropriately scoped.

The NCSC has published guidance on defending against social engineering. The fact that law firms are still being successfully targeted by a group using phone calls and video conferencing tells you everything about whether that guidance is being operationalised at the firm level.

Check Point CVE-2026-123039: Root Access, Active Exploitation, Patches Available

Check Point has released emergency hotfixes for CVE-2026-123039, a local privilege escalation vulnerability in Check Point Security Gateway appliances. Exploitation has been confirmed since late October 2026. The attack chain documented by Check Point Research involves PHP2Shell exploitation of vulnerable Mobile Access portals, followed by privilege escalation to root, deployment of PHP webshells for persistence, and in some confirmed cases, wiper malware deployment.

The campaign documented in Check Point’s own research targeted Israeli organisations specifically, with exploitation observed from a specific IP address approximately one week after fixes became available. That detail is worth pausing on. The window between patch publication and active exploitation in this case was seven days. For organisations that patch on a monthly cycle, that is a window that stays open for three weeks.

Check Point Security Gateways are common in UK enterprise and mid-market environments. They are also present in the supply chain of UK organisations through managed security service providers who run shared gateway infrastructure. If you are on a managed firewall service and do not know which gateway product your provider uses, that is a gap worth closing.

The CVE identifiers associated with this campaign from the OTX intelligence include CVE-2026-109618, CVE-2026-109619, and CVE-2026-123039. Emergency hotfixes have been released. If you are running Check Point Security Gateways with Mobile Access portals exposed, applying those hotfixes is not optional.

Actions:

If you manage Check Point gateways directly, apply the emergency hotfixes issued this week. Do not wait for your next maintenance window.
If a managed service provider manages your gateway, confirm in writing today that the hotfix has been applied and obtain the date and version.
Review access logs on your gateway for activity from late October onwards, particularly any anomalous PHP execution or unexpected outbound connections.
If your Mobile Access portal is internet-facing and unpatched, consider restricting access until the fix is confirmed applied.

A Note on the Wider Picture

All three of today’s items share a characteristic that is worth naming explicitly. None of them required a novel, undisclosed attack technique. SCKit exploited a legitimate remote management tool. Luna Moth exploited trust and a video call. The Check Point vulnerability was patched, attackers simply moved faster than the patch cycle.

The threat is not sophistication. The threat is speed, patience, and an accurate read of which organisations will be slow to respond. UK SMBs sitting behind MSPs that use ScreenConnect, UK law firms with Microsoft 365 Copilot, UK businesses with Check Point firewalls on a monthly patch cycle, none of those are unusual configurations. All three of them are in scope today.

If this briefing is useful to you, follow Threat Analysis wherever you listen so tomorrow’s brief lands automatically, and pass it to someone who needs the heads-up. The people who most need this information are usually the ones not yet reading it.

Sources

Source	Title	URL
Huntress	SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of Endpoints	https://www.huntress.com/blog/sckit-worm-rogue-screenconnect
Blackpoint Cyber	ScreenConnect Attack: SCKit Turns Remote Support Into an Attack Platform	https://blackpointcyber.com/blog/screenconnect-attack-sckit/
ReliaQuest	Threat Spotlight: Luna Moth Returns, Re-Targeting Law Firms Through Access Tokens	https://reliaquest.com/blog/threat-spotlight-luna-moth-returns-re-targeting-law-firms-through-access-tokens/
BleepingComputer	Check Point warns of zero-day flaw exploited for root access	https://www.bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access/
Check Point Research	PHP2Shell Exploitation on Check Point Gateway	https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/