---
title: Hunt: rogue ScreenConnect clients, the TrapWatch task and RelayTrap files from the Nov 11 MSP campaign | ctxsec
url: https://ctxsec.com/items/hunt-screenconnect-rogue-client-2588ef5c15954b10-trapwatch-relaytrap-sckit
description: "Huntress has published the infrastructure, client IDs and host artifacts from the Nov 11 ScreenConnect campaign. Look for a second ScreenConnect client on managed hosts, a SYSTEM scheduled task that runs every 10 seconds, and toolkit files in ProgramData and Windows Temp."
status: "vendor incident notice (Huntress, Nov 11-12, 2026); indicators from Huntress"
published: 2026-11-11
---

> Huntress has published the infrastructure, client IDs and host artifacts from the Nov 11 ScreenConnect campaign. Look for a second ScreenConnect client on managed hosts, a SYSTEM scheduled task that runs every 10 seconds, and toolkit files in ProgramData and Windows Temp.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-screenconnect-rogue-client-2588ef5c15954b10-trapwatch-relaytrap-sckit.md)

vendor incident notice (Huntress, Nov 11-12, 2026); indicators from Huntress

2026-11-11 7:41 PM ET

### Hunt: rogue ScreenConnect clients, the TrapWatch task and RelayTrap files from the Nov 11 MSP campaign

- **Network (block and search):** `185.99.255[.]28` (attacker ScreenConnect server and installer), relays `newnewnew.gotdns[.]org` and `soxnewwork.homedns[.]org`, second server `sc.payproofkit[.]com` / `155.94.150[.]39`, toolkit host `ns.mo7sen[.]dev`.
- **Rogue client IDs:** `2588ef5c15954b10`, `ed630cc2c873b091`. Any ScreenConnect client service whose instance ID isn't yours is suspect; most hosts should have exactly one.
- **Persistence:** scheduled task `TrapWatch` running as SYSTEM every 10 seconds.
- **Files:** `C:\ProgramData\RelayTrap\` (trap component and logs), `C:\Windows\Temp\sckit-*` (stager). BleepingComputer also lists `Panel-Lateral.ps1`, `runnew.cmd`, `ToolboxRelayUploader.exe`, `Run-Lateral-Full.bat`, installer URLs containing `&c=Exploited` and an operator name `Addmin`.
- **Process lineage:** the legitimate ScreenConnect client spawning `msiexec`, PowerShell or `schtasks` around 17:48 UTC Nov 11 onward.
- **Technician side:** treat any technician workstation that connected to an affected host as compromised; check for the same task and paths and for stolen browser sessions.

Sources: [Huntress Support: 2026 - November - ScreenConnect (indicators and response steps)](https://support.huntress.io/hc/en-us/articles/57422935234195-2026-November-ScreenConnect) · [ConnectWise Trust Center advisory: ScreenConnect precautionary extension disabling and partner guidance (Nov 11, 2026, 22:45 UTC)](https://www.connectwise.com/company/trust/advisories) · [BleepingComputer: Active ScreenConnect attacks breach MSPs, impact dozens of organizations (Nov 11, 2026)](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/)