malware
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign
High
Summary
A large-scale cyber campaign utilized the legitimate remote access tool ScreenConnect to deploy AsyncRAT malware onto compromised systems. Threat actors disguised installers of popular software like OBS Studio and DNS Jumper as malicious archives, leveraging DLL sideloading and bypassing security measures like Microsoft Defender exclusions and UAC prompts. The campaign targeted a wide range of users and organizations, establishing a complex C2 infrastructure for ongoing control.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data