Adversaries Leverage Malicious ScreenConnect Installers for Initial Compromise

Acronis’ Threat Research Unit (TRU) has observed a surge in cyberattacks leveraging trojanized versions of ConnectWise ScreenConnect since March 2025, with U.S. organizations most heavily targeted.

The campaigns highlight how attackers continue to repurpose trusted remote monitoring and management (RMM) software, using advanced delivery mechanisms and layered malware to maintain long-term persistence.

The infections begin when victims are lured by executable files disguised as financial or government paperwork, such as “agreement_support-pdf.Client.exe” or “Social_Security_Statement_Documents.exe.”

Once launched, the malicious file installs ScreenConnect through a small ClickOnce runner. Unlike traditional installers that hold embedded configurations, these stripped-down versions fetch their setup data directly from attacker-controlled servers, including domains like morco. provider [.]net, undermining older static detection techniques.

Within minutes, victim machines are linked to attacker-operated ScreenConnect servers hosted on VPS infrastructure tied to stealthrdp[.]com. From there, the attackers exploit ScreenConnect’s automation features to deploy additional malware seamlessly.

Dual-RAT Deployment and Customized Malware

Post-compromise activity demonstrates the attackers’ drive for redundancy and testing of different malware strains. Almost immediately, AsyncRAT is introduced through a multi-stage PowerShell chain that leverages AMSI bypass routines, scheduled tasks, and in-memory execution.

This RAT serves as a stable backdoor to maintain control, although its persistence mechanism, reloading every minute, was considered noisy by researchers.

In parallel, a bespoke PowerShell-based remote access trojan, not seen in open-source repositories, is deployed. This homemade RAT collects antivirus data, system identifiers, and OS architecture, then exfiltrates the information via Microsoft.XMLHTTP requests.

Its reliance on obfuscation, variable name manipulation, and encoded payloads complicates detection, while its command handler enables attackers to execute code, download files, and establish persistence using script-based techniques.

Just two weeks after initial access, the threat actors updated their infection method. New batch and VBS loaders were employed to stage obfuscated .NET assemblies, including an “Obfuscator.dll” that acted both as AsyncRAT’s loader and a persistence agent.

Shortly after this update, TRU identified yet another RAT, PureHVNC, delivered via process hollowing. By injecting its payload into RegAsm.exe, the actors gained stealthy control and additional interactive capabilities.

Infrastructure Reuse and Strategic Implications

A closer look at infrastructure revealed consistent reliance on preconfigured Windows Server 2022 virtual machines, with recurring hostnames such as WIN-BUNS25TD77J and COPY-OF-VM-2022.

These templates allowed rapid redeployment of ScreenConnect servers across new IP addresses, ensuring resiliency. Distribution channels reinforced the social engineering theme, with phishing attachments masquerading as legal, financial, or government documents.

Researchers caution that the combination of trusted RMM software, layered RAT deployment, and agile infrastructure rotation makes these campaigns difficult to suppress.

Defenders are urged to treat any unexpected ScreenConnect usage as suspicious, closely monitor for encoded PowerShell assemblies, and investigate anomalies linked to AsyncRAT or PureHVNC.

As adversaries refine their methods, the compromise of legitimate IT administration tools continues to represent one of the most effective vectors for long-term breaches.

Indicators of Compromise (IoCs)

Network:

• 169.156.208.185
• 185.196.9.158
• 185.196.8.100
• morco[.]rovider[.]net
• hxxps://eywordvailabom[.]com/sa/16-05.txt
• hxxps://systemwindowsupdate[.]com/alosh/logs.ldk
• hxxps://guilloton[.]fr/x.zip

Mutexes:

• AsyncMutex_al026
• AsyncMutex_alosh20215

Files:

• agreement_support-pdf.Client 67A32455A94B3396AD956CBDDA81D8ED1CD3727315159E025299057118DEB6AC
• Skype.ps1 BB182B8545B8C825811C6D09C738C230FE54BC96ADF1F10A3683B7E5294B5289
• 1.txt C260779FB1C9FF775739F6CF1853C9C33131ECF176737F6AF26B0AC60A6081DC

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates