Threat Actors Exploit ScreenConnect Installers for Initial Access

Cybersecurity: ConnectWise ScreenConnect Installer Exploitation

Since March 2025, there has been a notable increase in the misuse of ConnectWise ScreenConnect installers, primarily affecting businesses in the United States. Attackers are employing lightweight ClickOnce runner installers, which lack embedded configurations, to avoid static detection. These installers obtain malicious components during runtime.

Once installed, attackers automate the deployment of two remote access trojans (RATs): the publicly available AsyncRAT and a custom PowerShell-based RAT. The campaign has evolved to use batch and VBS loaders to deliver encoded .NET assemblies.

Phishing lures, disguised as financial or official documents, are predominantly used for distribution. Preconfigured Windows Server 2022 virtual machines (VMs) are being reused to expedite infrastructure changes.

Acronis Threat Research Unit (TRU) has documented multiple coordinated campaigns exploiting trojanized ConnectWise ScreenConnect installers to infiltrate corporate networks. The attacks likely originate from social engineering campaigns, predominantly distributed via email phishing.

The breach begins with a malicious ClickOnce installer, typically named to resemble legitimate documents, delivered through phishing emails. Once executed, the installer fetches the ScreenConnect.ClientSetup.exe from attacker-controlled servers and connects to the attacker’s ScreenConnect instance. This method of downloading configurations at runtime avoids static detection checks.

After installation, adversaries use automation features to deploy two RATs concurrently:

AsyncRAT Deployment: A batch script drops and extracts AsyncRAT alongside a PowerShell loader that dynamically loads assemblies in memory. A scheduled VBS task ensures continued execution. An internal mutex in AsyncRAT prevents redundant instances. Custom PowerShell RAT: A script deploys a custom PowerShell RAT, which disables AMSI, gathers host reconnaissance data, and exfiltrates data. It processes commands using obfuscated code and randomized names to hinder analysis.

Approximately two weeks post-compromise, attackers use batch and VBS loaders to retrieve and execute encoded .NET assemblies, maintaining persistence through a “Skype Updater” scheduled task.

The executables are often disguised as Social Security statements or business documents, indicating a heavy reliance on phishing techniques. Attackers use preconfigured Windows Server 2022 VMs for rapid redeployment across campaigns.

Organizations should consider RMM software as high-risk attack vectors and implement the following measures:

Allow-list ScreenConnect executables and block unauthorized ClickOnce installations. Monitor outgoing connections for anomalous ScreenConnect server addresses. Audit scheduled tasks, startup items, and PowerShell script execution logs for persistence artifacts. Educate employees to recognize phishing lures disguised as financial or legal documents.

Implementing these controls can help security teams detect malicious RMM activity earlier and disrupt attackers’ ability to use ScreenConnect for initial access.

Based on reporting by GBHackers.