{"id":3959,"date":"2026-07-01T13:03:58","date_gmt":"2026-07-01T13:03:58","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/01\/the-soc-files-screenconnect-masked-as-freeware-an-inside-look-at-a-large-scale-campaign\/"},"modified":"2026-07-01T13:03:58","modified_gmt":"2026-07-01T13:03:58","slug":"the-soc-files-screenconnect-masked-as-freeware-an-inside-look-at-a-large-scale-campaign","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/07\/01\/the-soc-files-screenconnect-masked-as-freeware-an-inside-look-at-a-large-scale-campaign\/","title":{"rendered":"The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign"},"content":{"rendered":"
\n

\"\"<\/p>\n

Introduction<\/h2>\n

To access compromised systems, threat actors frequently abuse<\/a> legitimate remote monitoring tools. At first glance, these utilities rarely raise red flags: they are signed with valid digital certificates, often allowlisted under corporate IT policies, and fully supported by OS vendors. However, they grant attackers the ability to harvest data from target devices, drop malware, and move laterally across the network.<\/p>\n

During a recent investigation engagement, the Kaspersky Managed Detection and Response<\/a> (MDR) team discovered the ScreenConnect remote access tool being leveraged to deploy and execute an AsyncRAT payload.<\/p>\n

A deep dive into this single incident unraveled a massive campaign distributing malicious installer archives hosted on spoofed websites. These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, Bandicam, and others. In total, we uncovered more than 90 domain names localized across 10 languages. The malicious archives bundle a legitimate, signed Microsoft install.exe<\/code> binary alongside a rogue install.res.1033.dll<\/code> library. It is loaded onto the device via DLL sideloading and deploys the ScreenConnect service, which awaits further instructions from the threat actors.<\/p>\n

As a result, what initially appeared to be an isolated ScreenConnect incident served as the starting point for a full investigation into the threat actor\u2019s C2 infrastructure. Every spoofed site we uncovered followed the exact same playbook: dropping a hidden ScreenConnect remote administration service under the guise of a legitimate software installer. This allowed the attackers to maintain control over compromised endpoints, with victims ranging from individual users to organizations.<\/p>\n

We continue to break down complex, multi-stage incidents like this in our ongoing The SOC Files series<\/a>. In this post, we take a deep dive into the technical execution of the ScreenConnect attack and analyze the broader infrastructure under the threat actor\u2019s control.<\/p>\n

Initial incident investigation<\/h2>\n

The investigation was triggered by an alert from Kaspersky MDR, which flagged the creation and execution of suspicious PowerShell and VBS scripts spawned by a ScreenConnect process.<\/p>\n

\nAbout ScreenConnect<\/summary>\n

ScreenConnect is a legitimate remote management utility. Kaspersky solutions detect it as not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen.<\/em><\/p>\n<\/details>\n

ScreenConnect was running as an Access-type service\u00a0\u2014 enabling direct remote connectivity\u00a0\u2014 with the server explicitly passed via the command line:<\/p>\n

\"ScreenConnect<\/a><\/p>\n

ScreenConnect service execution event with suspicious parameters<\/p>\n<\/div>\n

Once running, ScreenConnect created and executed a PowerShell script named Fj5NmEsp9EuKrun.ps1<\/code>:<\/p>\n

\"Malicious<\/a><\/p>\n

Malicious PowerShell script creation<\/p>\n<\/div>\n

Below is an excerpt from the contents of the script:<\/p>\n

\"Snippet<\/a><\/p>\n

Snippet of Fj5NmEsp9EuKrun.ps1<\/p>\n<\/div>\n

This script configures Microsoft Defender exclusions for the following objects:<\/p>\n