Beyond Trust: A New Campaign Is Using a Legitimate Tool to Deliver RATs

A new Hunt Intelligence report reveals that attackers are abusing ConnectWise ScreenConnect (formerly ConnectWise Control) to deliver AsyncRAT and custom malware payloads, turning a trusted remote monitoring and management tool into a malware delivery vector with supply chain implications.

According to the report, investigators uncovered at least eight infrastructure hosts staging ScreenConnect installers linked to AsyncRAT activity, with open directories containing archives such as aA[.]zip and 99[.]zip that unpack into toolkits including Ab.vbs, Skype.ps1, libPK.dll, and Microsoft.lnk. The attackers blend remote management software abuse with commodity RAT delivery, highlighting a supply-chain risk and the operational tradecraft used to evade signature-based defenses.

Key findings include payload containers named logs[.]ldk, logs[.]idk and logs[.]idr, and some hashes undetected on VirusTotal, indicating fresh repackaging. The campaign uses in-memory and native execution techniques, with persistence via scheduled tasks like SystemInstallTask and 3losh running every 2–10 minutes. Related campaigns have been linked to a May 2025 ConnectWise breach of its cloud-hosted ScreenConnect infrastructure, tied to CVE-2025-3935, a critical ViewState injection flaw.