Weaponized ScreenConnect App Spreads AsyncRAT and PowerShell RAT

Remote Monitoring and Management tools such as ConnectWise ScreenConnect are being abused as Trojan delivery vectors, with installers trojanised to deploy dual Remote Access Trojans—AsyncRAT and a custom PowerShell RAT—against U.S. organisations, according to Hunt[.]io.

Recent investigations reveal a reusable infrastructure pattern where trojanised ScreenConnect installers are hosted in open directories and fetch payloads via dynamic /Bin/ paths, with at least eight infrastructure hosts exposing installers named logs[.]ldk, logs[.]idr and variations thereof, ranging from 60 KB to 3 MB in size.

When executed, the installers trigger a multi-stage sequence: a VBScript or JavaScript dropper launches a shortcut that runs a PowerShell loader (Skype.ps1), which reconstructs embedded payload blobs and loads them in memory or via native injection using libPK.dll.

The first stage often uses a ClickOnce-style installer retrieved from a /Bin/ directory, blending social engineering lures with trusted ScreenConnect branding, while persistence is achieved through scheduled tasks named SystemInstallTask or 3losh run as frequently as every two minutes. Network activity for AsyncRAT spans ports 21, 80, 443 and high, ephemeral ports often TLS-wrapped, with dynamic domain rotation used to evade detection.

To counter this, defenders are urged to enforce strict RMM installer controls, shift to behaviour-focused detection, and monitor for indicators such as Skype.ps1 loaders and /Bin/ payload patterns.