This campaign abuses ScreenConnect, a legitimate remote administration utility, by bundling it with fake installers distributed via phishing websites designed to look like official pages for popular free software. The attackers use DLL sideloading to install ScreenConnect without user awareness, then execute malicious scripts to disable security mechanisms (Windows Defender exclusions, UAC) and deploy AsyncRAT. AsyncRAT connects to attacker-controlled command-and-control servers to receive instructions. Persistence is maintained through scheduled Windows tasks. The campaign targets enterprise environments to gain unauthorized access, likely for resale on cybercrime marketplaces. Kaspersky's detection classifies this use of ScreenConnect as not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen. Mitigation includes application allowlisting, monitoring for new remote management tools and scheduled tasks, and filtering outbound traffic to unknown destinations.

The campaign enables attackers to gain unauthorized remote access to enterprise systems by deploying AsyncRAT through a weaponized ScreenConnect installation. This can lead to data harvesting, lateral movement within networks, and persistent control of compromised machines. Security features such as Windows Defender and User Account Control are disabled or bypassed, increasing the risk of further compromise. The ultimate impact is unauthorized access and potential resale of compromised systems on cybercrime marketplaces.

No official patch is applicable since ScreenConnect is a legitimate tool misused by attackers. Organizations should enforce strict application control policies, including software allowlisting and restricting MSI installations from unverified sources. Monitoring for the installation of new remote management utilities and suspicious scheduled tasks is recommended. Outbound network traffic from workstations should be filtered to block connections to unknown IP addresses and domains. Utilizing managed detection and response services, such as Kaspersky MDR, can help detect and respond to such threats. These measures address the specific attack vector described and are aligned with vendor recommendations.