Acronis TRU Uncovers Surge in ScreenConnect Abuse with Dual-RAT Deployment

Acronis Threat Research Unit (TRU) has published findings on a campaign that abuses ConnectWise ScreenConnect, a legitimate remote monitoring and management tool, to deliver multiple remote access trojans. Since March 2025, researchers have observed a surge in attacks targeting U.S.-based organisations.

According to TRU, “what we’re seeing is a long-term, ongoing trend in RMM tool abuse that continues to draw attackers, perhaps due to how effective it is.” The attackers modify ScreenConnect installers to disguise them as official documents, with samples such as agreement_support-pdf.Client.exe downloaded via Microsoft Edge. The report notes that this file is a ClickOnce installer, disguised as a legitimate support document—a social engineering method used to trick users into running untrusted code.

After installation, two RATs are deployed: AsyncRAT and a custom PowerShell-based RAT, which performs reconnaissance and data exfiltration, and uses obfuscation. TRU highlights redundancy in the chain and the use of batch and VBS loaders, leading to persistence via a scheduled task named “Skype Updater.”