Perceptive Security
SOC/SIEM Consultancy
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
Published:
1 juli 2026 om 17:53:06
Alert date:
1 juli 2026 om 19:17:24
Source:
thehackernews.com
Ransomware & Malware, Web Technologies, Identity & Access, Data Breach & Exfiltration
Unknown threat actors are conducting a massive, multi-domain, multi-language campaign using SEO poisoning to distribute malicious software installers. The installers are hosted on spoofed websites impersonating popular software such as OBS Studio, DNS Jumper, DS4Windows, and Bandicam. Once executed, these fake installers leverage the legitimate ScreenConnect remote access tool to deploy and execute AsyncRAT on victim machines. The campaign was identified and reported by Kaspersky. The use of legitimate remote access tools like ScreenConnect as a delivery mechanism helps attackers evade detection. This campaign poses a significant threat to users who search for and download popular software from unofficial sources.
Technical details
Unknown threat actors are conducting a massive, multi-domain, multi-language campaign using SEO poisoning to push spoofed software websites to the top of search results on Google and Bing. These sites distribute malicious installer archives disguised as popular software including OBS Studio, DNS Jumper, DS4Windows, and Bandicam. The malicious archives bundle a legitimate signed Microsoft install.exe binary with a rogue install.res.1033.dll library, which is loaded via DLL side-loading to deploy the ScreenConnect remote access tool. Once ScreenConnect is running, it executes a PowerShell script (Fj5NmEsp9EuKrun.ps1) that configures Microsoft Defender exclusions, disables UAC prompts, and creates a VBScript file (installer_method3_stream.vbs). This VBScript drops five files in C:\Users\Public: msgbox.txt, secret_bytes.txt, 1.vb, cap.ps1, and script.vbs. The script.vbs terminates active PowerShell processes and runs cap.ps1 in a hidden window, which reads secret_bytes.txt, extracts the AsyncRAT module, and executes it via process hollowing (T1055.012). AsyncRAT then connects to the C2 server mora1987.work[.]gd, enabling remote control, data theft, and screen recording. Persistence is maintained via a scheduled task named MasterPackager.Updater that triggers every two minutes to re-execute script.vbs. Over 90 domain names localized across 10 languages (English, Russian, Chinese, German, French, Spanish, Portuguese, Arabic, and others) were identified, with some domains registered between August 2025 and March 2026.
Mitigation steps:
1. Block or monitor outbound connections to mora1987.work[.]gd and any associated IP addresses. 2. Detect and alert on unauthorized use of ScreenConnect, especially when deployed outside of approved IT channels. 3. Monitor for DLL side-loading patterns involving install.exe and install.res.1033.dll. 4. Alert on creation of scheduled tasks named MasterPackager.Updater or tasks executing every two minutes from non-standard locations. 5. Monitor C:\Users\Public for creation of suspicious files including script.vbs, cap.ps1, secret_bytes.txt, and related files. 6. Alert on PowerShell scripts modifying Microsoft Defender exclusions or disabling UAC. 7. Implement application whitelisting to prevent unauthorized execution of ScreenConnect installers. 8. Educate users about the risk of downloading software from unofficial or sponsored search result links. 9. Use DNS filtering to block known malicious domains associated with this campaign. 10. Monitor for process hollowing techniques (MITRE ATT&CK T1055.012) in endpoint detection tools. 11. Verify software downloads against official vendor websites and check file hashes before execution. 12. Block or restrict PowerShell execution in environments where it is not required.
Affected products:
Windows (any version supporting ScreenConnect and PowerShell)
ScreenConnect (ConnectWise Remote Access Tool - abused as attack vector)
AsyncRAT (deployed malware)
OBS Studio (impersonated/spoofed)
DNS Jumper (impersonated/spoofed)
DS4Windows (impersonated/spoofed)
Bandicam (impersonated/spoofed)
Related links:
https://www.forcepoint.com/blog/x-labs/asyncrat-reloaded-python-trycloudflare-malware
https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/
https://attack.mitre.org/techniques/T1055/012/
Related CVE's:
Related threat actors:
IOC's:
mora1987.work[.]gd (C2 server), install.res.1033.dll (malicious DLL used for side-loading), Fj5NmEsp9EuKrun.ps1 (malicious PowerShell script), installer_method3_stream.vbs (malicious VBScript), msgbox.txt (dropped file in C:\Users\Public), secret_bytes.txt (dropped file containing AsyncRAT payload in C:\Users\Public), 1.vb (dropped file in C:\Users\Public), cap.ps1 (dropped PowerShell script in C:\Users\Public), script.vbs (dropped VBScript in C:\Users\Public), MasterPackager.Updater (persistence scheduled task name), C:\Users\Public (directory used for dropped files)
This article was created with the assistance of AI technology by Perceptive.