The campaign that hides behind valid signatures and uses ScreenConnect to deploy AsyncrAT and evade detection

A massive campaign has exploited the legitimate ScreenConnect (ConnectWise Control) remote access tool as a vector to deploy AsyncrAT, a back door that allows remote control, information theft and screen surveillance. The attackers have created false websites that mimic official popular profit pages and, thanks to search engine optimization techniques, have managed to position them in Google and Bing results to fool victims who seek legitimate downloads.

The central intrusion technique is ingenious and dangerous: installer files contain an executable signed by Microsoft along with a malicious DLL library that is charged by DLL side-rolling, which allows to start the ScreenConnect service without immediately raising suspicions. After this, the attack runs scripts that manipulate system security - setting exclusions in Microsoft Defender, weakening UAC and using VBScript and PowerShell - to deploy the AsyncrAT module by process holding, a technique that injects code into legitimate processes to avoid detection. This combination makes the commitment legitimate in many automatic and manual controls.

The implications are clear: to be blindly confident that a binary is signed or that a service is known is not enough to ensure safety. The attackers take advantage of the reputation of popular applications and the ability to manipulate search results to amplify their reach, affecting domestic users and organizations alike. In addition, the implementation of persistence through a scheduled task that is carried out every two minutes ensures that the threat survives at rebeginnings and makes it difficult to eradicate it if not detected in time.

In terms of detection and response, there are specific signals that can help identify commitments: presence of unusual files in C:\ Users\ Public, programmed tasks with suspicious names, scripts that end PowerShell processes and modifications to Defender exclusions. EDR tools and event records are key to rebuilding the attack chain and confirming whether exfiltration or screenshots have occurred. To understand the injection technique used it is useful to consult technical descriptions such as those published by MITRE on process holding.

As concrete mitigation measures it is recommended, first, not to download software from organic results without verifying the official URL of the supplier and to prefer verified repositories or stores. In corporate environments, limiting software installation through group policies and application control reduces the attack surface. It is essential to activate the protection against manipulation in anti-malware solutions, to audit and block changes in security exclusions, and to monitor programmed tasks and newly created services. Microsoft offers guides and controls to harden Defender and telemetry that should be reviewed in its recommendations for endpoints protection: Microsoft Defender for Endpoint.

If commitment is suspected, it is most prudent to isolate the network equipment, preserve evidence (logs, memory images) and coordinate with the incident response team for forensic analysis. Reestablish affected credentials, audit access and review other endpoints to detect side movements should be part of the response. In parallel, assessing the locking of the ScreenConnect / ConnectWise Control tool in environments where it is not strictly necessary or applying white lists and network controls will help prevent malicious reuses of the same vector; product information can be consulted on the official ConnectWise Control page: ConnectWise Control.

In short, this campaign shows that the threat does not always come in a clearly malicious file: the combination of social engineering, abuse of valid signatures, lateral loading of DLL and avoidance techniques like process holding requires an in-depth defense that combines prevention, behavioral-based detection and rapid response. Update download and verification processes, strengthen endpoint controls and maintain updated incident response procedures are practical steps that significantly reduce the risk of such intrusions.