The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

Strategic summary

The report reveals a large-scale campaign where attackers abuse the legitimate remote access tool ScreenConnect to distribute AsyncRAT malware. Malicious installers are disguised as popular freeware applications like OBS Studio and Bandicam, hosted on over 90 spoofed websites across 10 languages. These installers bundle a signed Microsoft executable to bypass security and deploy the remote access trojan. The campaign highlights how trusted tools can be weaponized for stealthy system compromise and data theft.

Key findings

• Threat actors exploit the legitimate remote monitoring tool ScreenConnect to drop AsyncRAT payloads, blending into normal IT environments.
• The campaign leverages over 90 spoofed domains across 10 languages, distributing fake installers for well-known software like OBS Studio, DNS Jumper, and Bandicam.
• Malicious archives contain a valid, digitally signed Microsoft executable (install.exe) alongside the malware, evading detection by security software.
• The attack chain involves disguised freeware downloads that ultimately install AsyncRAT, enabling unauthorized remote access, data exfiltration, and lateral movement.
• This campaign demonstrates a growing trend of abusing legitimate tools and software distribution channels to proliferate remote access trojans.