# AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access (SEO-Poisoned Fake Installer Sites)

> Since October 2025, unknown financially motivated actors have run a massive, multi-language SEO-poisoning campaign distributing over 90 typosquatted fake-installer websites impersonating OBS Studio, DNS Jumper, Bandicam, DS4Windows, Process Hacker, Glary Utilities and other popular free tools. Victims who download the fake installers trigger DLL sideloading via a Microsoft-signed install.exe paired with a malicious install.res.1033.dll, which silently installs ScreenConnect and, through a PowerShell/VBScript chain, process-hollows AsyncRAT into RegAsm.exe for persistent credential theft and remote access.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1081
- **ID:** TL-2026-1081
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kaspersky's Managed Detection and Response (MDR) team escalated a single suspicious alert that unraveled a large-scale, multi-domain, multi-language campaign active since at least October 2025 (with domain registrations beginning around August 2025 and peaking in February 2026; activity paused at the end of March 2026, though many fraudulent pages remain live). The operators registered 90+ typosquatted domains across 10 languages (English, Russian, Chinese, German, French, Spanish, Portuguese, Arabic) impersonating legitimate free software — OBS Studio, DNS Jumper, Bandicam, DS4Windows, Process Hacker, Glary Utilities, Lossless Scaling, CrosshairX, Defender Control and 20+ others — and used SEO poisoning to push these sites to the top of Google and Bing search results.

Victims download an archive (e.g. obs-studio-windows-x64.zip) from hosts such as fileget.loseyourip.com or direct-download.giize.com. The archive bundles a legitimate, Microsoft-signed install.exe (MD5 87603ea025623b19954e460add532048) alongside a malicious install.res.1033.dll (17+ hash variants observed). When install.exe runs, Windows' DLL search-order behavior loads the rogue DLL (T1574.002), which silently installs a renamed ScreenConnect MSI (masquerading as vcredist_x64.dll) via `msiexec.exe /i ... /qn /norestart` (T1218.007) while the legitimate free software (masquerading as vcredist_x86.dll) installs normally as cover. ScreenConnect is abused specifically because it is commonly allowlisted under workplace security policies, letting the operators move around undetected once remote access is established (T1219).

Once ScreenConnect is live, it drops and executes Fj5NmEsp9EuKrun.ps1, which creates Microsoft Defender exclusions for system drives and specific processes and sets the registry value ConsentPromptBehaviorAdmin=0 to silently disable UAC prompts (T1548.002, T1562.001). A follow-on VBScript, installer_method3_stream.vbs, stages payload files into C:\Users\Public\ and launches script.vbs, which terminates PowerShell processes to cover tracks and launches cap.ps1 in hidden mode. cap.ps1 reads secret_bytes.txt, an XOR-encrypted (key 0xA7) and bit-inverted embedded PE, decrypts and reflectively loads it, then invokes ConsoleApp1.Module1.Run() via .NET reflection (T1027, T1140, T1106). This module spawns RegAsm.exe with CREATE_SUSPENDED and injects the decrypted AsyncRAT payload via process hollowing (T1055.012), giving the attacker a legitimate-looking process (RegAsm.exe, a Microsoft .NET utility) hosting the RAT.

Persistence is established with a scheduled task — `schtasks /Create /TN "MasterPackager.Updater" /TR "wscript.exe \"C:\Users\Public\script.vbs\"" /SC MINUTE /MO 2 /F` — that re-triggers the entire loader chain every two minutes, surviving reboots (T1053.005). The injected RegAsm process then calls back to AsyncRAT and ScreenConnect C2 infrastructure (e.g. mora1987.work.gd for AsyncRAT; servermanagemen.xyz, r.manage-server.xyz, winservec.net, manageserver.xyz, cloudsynn.com, pingserv.pro, ehostservers.xyz, serverdnsplan.net, pingpanl.pro, managedevice.xyz, edgeserv.ru for ScreenConnect), giving the operator an encrypted, persistent channel (T1573, T1071.001, T1105).

AsyncRAT is an open-source .NET RAT with keylogging (via SetWindowsHookEx, T1056.001), screen/audio capture (T1113, T1123), stored-credential/password recovery (T1555), remote shell, webcam access, and payload injection capabilities, plus built-in virtualization/sandbox evasion (T1497). The campaign's infrastructure spans at least two clusters: Cluster 1 (162.216.241.242, Dynu Systems US, hosting spoofed portals; 198.23.185.81, NOHAVPS LLC US, hosting malicious archives) and Cluster 2 (2.59.134.97, dataforest GmbH Germany, hosting both portals and download resources). Kaspersky assesses the campaign as moderately sophisticated — it relies on abusing legitimate, signed software and allowlisted remote-access tooling plus basic obfuscation rather than novel exploit development — and attributes no specific named threat actor or nation-state; the stated objective is mass credential harvesting for resale on underground/dark-web marketplaces and as an entry point into larger intrusions.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053 Scheduled Task/Job
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access](https://cybersecuritynews.com/asyncrat-campaign-uses-dll-sideloading/)
- [The SOC files: ScreenConnect campaign with AsyncRAT](https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/)
- [SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT](https://thehackernews.com/2026/07/seo-poisoned-software-sites-abuse.html)
- [Kaspersky warns of a large-scale campaign using fake free software to deploy a RAT via ScreenConnect](https://www.kaspersky.com/about/press-releases/kaspersky-warns-of-a-large-scale-sampaign-using-fake-free-software-to-deploy-a-rat-via-screenconnect)
- [ScreenConnect abused to deploy AsyncRAT in widespread campaign](https://www.scworld.com/brief/screenconnect-used-to-deploy-asyncrat-in-widespread-campaign)
- [ScreenConnect Malware Campaign Uses SEO Poisoning to Target Freeware Downloads](https://cyberpress.org/seo-poisoning-spreads-screenconnect/)
- [Kaspersky warns of fake software attack](https://cajnewsafrica.com/2026/07/02/kaspersky-warns-of-fake-software-attack/)
- [Input Capture: Keylogging, Sub-technique T1056.001 - Enterprise | MITRE ATT&CK](https://attack.mitre.org/techniques/T1056/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1081