Attackers abuse ConnectWise ScreenConnect to drop AsyncRAT

Attackers are using a compromised ConnectWise ScreenConnect installation to deploy AsyncRAT, with LevelBlue researchers warning of a scripted loader campaign that abuses the remote desktop tool to drop the malware. According to LevelBlue, the operators initiate an interactive session via a malicious domain linked to unauthorized ScreenConnect deployments and then trigger VBScript-powered PowerShell commands to fetch two payloads, which are loaded and executed in memory.

The campaign uses a fileless approach, with Obfuscator.dll initiating persistence via a fake “Skype Updater” and disabling AMSI and ETW, followed by AsyncClient.exe, the core AsyncRAT C2 engine that decrypts config with AES-256 and exfiltrates data while monitoring user activity with a keylogger. The two first-stage payloads, logs[.]ldk and logs[.]ldr, are written to the public directory but ultimately executed in memory, avoiding disk writes.

The researchers note that the technique relies on legitimate system tools for execution and that the infection chain aims to maintain stealth and persistence through scheduled tasks and in-memory operation. According to LevelBlue, this fileless malware approach makes detection, analysis, and eradication more challenging.