AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access (SEO-Poisoned Fake Installer Sites)
AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for (TL-2026-1081), also tracked as SEO-Poisoned ScreenConnect/AsyncRAT Campaign, is a high-severity malware campaign, first published 2026-07-02. It has no confirmed attribution, affects Microsoft Windows (all supported desktop versions), maps to 28 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 44 indicators of compromise.
Key facts for TL-2026-1081
- Threat ID
- TL-2026-1081
- Also known as
- SEO-Poisoned ScreenConnect/AsyncRAT Campaign, The SOC Files: ScreenConnect Campaign with AsyncRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-02
- Last reviewed
- 2026-07-02
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all sectors general consumer enterprise freeware users, gaming, technology, small business
- Target regions
- Global, North America, Europe, Asia, Middle East
- Detection rules
- 9
- Indicators of compromise
- 44
Malware and tooling in AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for
Malware and tooling: AsyncRAT, ScreenConnect
Since October 2025, unknown financially motivated actors have run a massive, multi-language SEO-poisoning campaign distributing over 90 typosquatted fake-installer websites impersonating OBS Studio, DNS Jumper, Bandicam, DS4Windows, Process Hacker, Glary Utilities and other popular free tools. Victims who download the fake installers trigger DLL sideloading via a Microsoft-signed install.exe paired with a malicious install.res.1033.dll, which silently installs ScreenConnect and, through a PowerShell/VBScript chain, process-hollows AsyncRAT into RegAsm.exe for persistent credential theft and remote access.
How AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for works
Kaspersky's Managed Detection and Response (MDR) team escalated a single suspicious alert that unraveled a large-scale, multi-domain, multi-language campaign active since at least October 2025 (with domain registrations beginning around August 2025 and peaking in February 2026; activity paused at the end of March 2026, though many fraudulent pages remain live). The operators registered 90+ typosquatted domains across 10 languages (English, Russian, Chinese, German, French, Spanish, Portuguese, Arabic) impersonating legitimate free software — OBS Studio, DNS Jumper, Bandicam, DS4Windows, Process Hacker, Glary Utilities, Lossless Scaling, CrosshairX, Defender Control and 20+ others — and used SEO poisoning to push these sites to the top of Google and Bing search results.
Victims download an archive (e.g. obs-studio-windows-x64.zip) from hosts such as fileget.loseyourip.com or direct-download.giize.com. The archive bundles a legitimate, Microsoft-signed install.exe (MD5 87603ea025623b19954e460add532048) alongside a malicious install.res.1033.dll (17+ hash variants observed). When install.exe runs, Windows' DLL search-order behavior loads the rogue DLL (T1574.002), which silently installs a renamed ScreenConnect MSI (masquerading as vcredist_x64.dll) via `msiexec.exe /i ... /qn /norestart` (T1218.007) while the legitimate free software (masquerading as vcredist_x86.dll) installs normally as cover. ScreenConnect is abused specifically because it is commonly allowlisted under workplace security policies, letting the operators move around undetected once remote access is established (T1219).
Once ScreenConnect is live, it drops and executes Fj5NmEsp9EuKrun.ps1, which creates Microsoft Defender exclusions for system drives and specific processes and sets the registry value ConsentPromptBehaviorAdmin=0 to silently disable UAC prompts (T1548.002, T1562.001). A follow-on VBScript, installer_method3_stream.vbs, stages payload files into C:\Users\Public\ and launches script.vbs, which terminates PowerShell processes to cover tracks and launches cap.ps1 in hidden mode. cap.ps1 reads secret_bytes.txt, an XOR-encrypted (key 0xA7) and bit-inverted embedded PE, decrypts and reflectively loads it, then invokes ConsoleApp1.Module1.Run() via .NET reflection (T1027, T1140, T1106). This module spawns RegAsm.exe with CREATE_SUSPENDED and injects the decrypted AsyncRAT payload via process hollowing (T1055.012), giving the attacker a legitimate-looking process (RegAsm.exe, a Microsoft .NET utility) hosting the RAT.
Persistence is established with a scheduled task — `schtasks /Create /TN "MasterPackager.Updater" /TR "wscript.exe \"C:\Users\Public\script.vbs\"" /SC MINUTE /MO 2 /F` — that re-triggers the entire loader chain every two minutes, surviving reboots (T1053.005). The injected RegAsm process then calls back to AsyncRAT and ScreenConnect C2 infrastructure (e.g. mora1987.work.gd for AsyncRAT; servermanagemen.xyz, r.manage-server.xyz, winservec.net, manageserver.xyz, cloudsynn.com, pingserv.pro, ehostservers.xyz, serverdnsplan.net, pingpanl.pro, managedevice.xyz, edgeserv.ru for ScreenConnect), giving the operator an encrypted, persistent channel (T1573, T1071.001, T1105).
AsyncRAT is an open-source .NET RAT with keylogging (via SetWindowsHookEx, T1056.001), screen/audio capture (T1113, T1123), stored-credential/password recovery (T1555), remote shell, webcam access, and payload injection capabilities, plus built-in virtualization/sandbox evasion (T1497). The campaign's infrastructure spans at least two clusters: Cluster 1 (162.216.241.242, Dynu Systems US, hosting spoofed portals; 198.23.185.81, NOHAVPS LLC US, hosting malicious archives) and Cluster 2 (2.59.134.97, dataforest GmbH Germany, hosting both portals and download resources). Kaspersky assesses the campaign as moderately sophisticated — it relies on abusing legitimate, signed software and allowlisted remote-access tooling plus basic obfuscation rather than novel exploit development — and attributes no specific named threat actor or nation-state; the stated objective is mass credential harvesting for resale on underground/dark-web marketplaces and as an entry point into larger intrusions.
MITRE ATT&CK techniques used in TL-2026-1081
Collection
T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API
Persistence
Credential Access
T1056 Input Capture; T1555 Credentials from Password Stores
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Initial Access
execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for
- Microsoft — Windows (all supported desktop versions)
Vulnerable versions: Any Windows host where a user executes the fake installer - ConnectWise — ScreenConnect
Vulnerable versions: Abused as legitimate RMM software, not a vulnerable version
Remediation for AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for
Immediate actions
- Block outbound traffic to the identified AsyncRAT and ScreenConnect C2 domains and IPs at the perimeter/DNS layer
- Hunt for the MasterPackager.Updater scheduled task and any wscript.exe execution of script.vbs from C:\Users\Public
- Search EDR telemetry for RegAsm.exe with anomalous network connections or child-process/injection activity (code_injection_to_unusual_process)
- Audit Microsoft Defender exclusion lists for unauthorized entries covering system drives or ScreenConnect/PowerShell processes
- Revoke/rotate credentials on any host confirmed to have executed the fake installers
Workarounds
- Enforce application allowlisting to block execution of unsigned/renamed MSI packages disguised as VCRedist installers
- Monitor and alert on scheduled task creation targeting scripts staged in C:\Users\Public
Longer-term hardening
- Deploy EDR behavioral detection for process hollowing into legitimate .NET utilities (RegAsm.exe, RegSvcs.exe, InstallUtil.exe)
- Restrict ScreenConnect (and other RMM tools) to explicitly authorized instances/organization IDs via application allowlisting; block unauthorized ClientService.exe installations
- Implement DNS/web filtering and SEO-poisoning-aware browsing protections for freeware download sites
- Deploy Sigma rule for Windows Event ID 4697 (service creation) matching ScreenConnect parameters (e=Access, e=Support, ClientService.exe)
- User security awareness training on verifying software download sources and avoiding third-party mirrors for free tools
Timeline of AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for
- Threat actors begin registering typosquatted domains impersonating OBS Studio, DNS Jumper, Bandicam, DS4Windows, and other free software across 10 languages
- SEO-poisoned fake installer campaign goes live, distributing malicious archives bundling a Microsoft-signed install.exe with a malicious install.res.1033.dll
- Domain registrations linked to the campaign peak, with the fraudulent portal count surpassing 90 sites across delivery clusters in the US and Germany
- Observed campaign activity pauses, though many fraudulent installer pages remain live and reachable
- Kaspersky Managed Detection and Response (MDR) team escalates a single suspicious alert that is traced back to the wider 90+-domain campaign
- The Hacker News, SC Media, Cyberpress and other outlets publish coverage of the SEO-poisoned ScreenConnect/AsyncRAT campaign
- Kaspersky Securelist publishes 'The SOC files: ScreenConnect campaign with AsyncRAT,' detailing the full infection chain, IOCs, and detection guidance
- Cyber Security News and CAJ News Africa publish follow-on reporting summarizing the campaign and its IOCs
Sources cited for AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for
- AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access
- The SOC files: ScreenConnect campaign with AsyncRAT
- SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT
- Kaspersky warns of a large-scale campaign using fake free software to deploy a RAT via ScreenConnect
- ScreenConnect abused to deploy AsyncRAT in widespread campaign
- ScreenConnect Malware Campaign Uses SEO Poisoning to Target Freeware Downloads
- Kaspersky warns of fake software attack
- Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK
Threats related to AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for
- ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software Sites
- GPU-Targeted Cryptojacking Campaign — SEO + AI Chatbot Poisoning Delivers ScreenConnect & SimpleRunPE Process Hollowing into .NET Utilities (Microsoft Defender Experts)
- Pony (Fareit/Siplog) Credential-Stealing Trojan and Downloader
- Agent Tesla .NET Remote Access Trojan — Credential and Data Theft via Keylogging and MaaS Operations
- The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM Access
- Tiflux RMM Triple-Threat Campaign — Service-Agreement Malspam Chains UltraVNC + Splashtop + ScreenConnect with BYOVD HwRwDrv.sys for Privilege Escalation
Detection coverage for TL-2026-1081
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1081 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1081
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.