Bandicam, ScreenConnect and OBS Studio: How a single ScreenConnect incident exposed a massive campaign

Cybercriminals Exploit Legitimate Remote Access Tool in Large-Scale Malware Campaign

In a recent investigation, Kaspersky’s Managed Detection and Response (MDR) team uncovered a sophisticated cyberattack leveraging ScreenConnect, a legitimate remote monitoring tool, to deploy AsyncRAT malware. The campaign, active since October 2025, spans over 90 spoofed domains in 10 languages, targeting users worldwide through typosquatted websites impersonating popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam.

How the Attack Works

1. Initial Compromise

   • Victims unknowingly download malicious installers from fraudulent websites ranking high in search engine results due to SEO manipulation.
   • The downloaded archives (e.g., obs-studio-windows-x64.zip) contain a legitimate Microsoft-signed install.exe alongside a malicious install.res.1033.dll library.
   • Upon execution, the DLL sideloads ScreenConnect, installing it silently via msiexec.exe under the guise of a "Microsoft Update Service."

2. Post-Exploitation Tactics

   • ScreenConnect deploys PowerShell and VBS scripts to:
     • Disable Microsoft Defender by excluding critical directories (C:, C:\Users\Public).
     • Turn off User Account Control (UAC) by modifying registry keys.
     • Terminate running PowerShell processes to evade detection.
   • A VBScript (installer_method3_stream.vbs) drops five files in C:\Users\Public, including secret_bytes.txt, which contains an XOR-encrypted AsyncRAT payload.
   • The malware uses process hollowing to inject AsyncRAT into RegAsm.exe, a trusted Windows process, and establishes persistence via a scheduled task (MasterPackager.Updater) that re-executes every two minutes.

3. Command-and-Control (C2) Infrastructure

   • AsyncRAT connects to mora1987[.]work[.]gd and other C2 domains.
   • ScreenConnect’s C2 servers (e.g., r.servermanagemen[.]xyz) are embedded in system.config XML files within the MSI packages.

Campaign Scale & Infrastructure

• Spoofed Websites: Over 90 domains mimic software vendors, hosted across three IP clusters (U.S. and Germany).
  • Cluster 1 (162.216.241[.]242, 198.23.185[.]81): Initially used for gaming-themed lures, later shifted to freeware impersonation.
  • Cluster 2 (2.59.134[.]97): Focused exclusively on fake software portals.
• Global Reach: Domains localized in English, Russian, Chinese, German, French, Spanish, and Arabic, indicating a broad targeting strategy.
• SEO Abuse: Fraudulent sites appear at the top of search results for queries like "OBS Studio download," increasing victim exposure.

Impact & Objectives

• Targets: Both individual users and corporate networks, where remote access tools are often allowlisted.
• Goal: Likely credential theft and unauthorized system access, with compromised endpoints potentially resold on dark web marketplaces.
• Persistence: The attack chain ensures long-term control over infected devices via ScreenConnect and AsyncRAT.

Detection & Indicators

Kaspersky’s MDR detected the attack through:

• ScreenConnect service creation with suspicious parameters.
• Anomalous child processes (e.g., powershell.exe, schtasks.exe) spawned by ScreenConnect.
• Malware signatures (e.g., Trojan.Win64.DLLhijack., Trojan.VBS.Agent.).

Key IOCs:

• Malicious DLL: install.res.1033.dll (MD5: 5F96C04E3AFAE97017B201BE112284D2).
• C2 Domains: mora1987[.]work[.]gd, servermanagemen[.]xyz.
• Fake Websites: studioobs[.]com, dnsjumper[.]app, ds4windows[.]pro.

The campaign highlights the risks of trusted remote tools and typosquatting, underscoring the need for strict software controls and outbound traffic monitoring. Many fraudulent domains remain active as of publication.

Source: https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/

Bandicam Company cybersecurity rating report: https://www.rankiteo.com/company/bandicam

Obsidian Media cybersecurity rating report: https://www.rankiteo.com/company/obsidian-media

ConnectWise cybersecurity rating report: https://www.rankiteo.com/company/connectwise

"id": "BANOBSCON1782901541",
"linkid": "bandicam, obsidian-media, connectwise",
"type": "Cyber Attack",
"date": "3/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'location': 'Worldwide',
                        'type': 'Individual Users and Corporate Networks'}],
 'attack_vector': ['Typosquatting',
                   'SEO Manipulation',
                   'DLL Sideloading',
                   'Process Hollowing'],
 'data_breach': {'data_encryption': 'XOR-encrypted AsyncRAT payload',
                 'data_exfiltration': 'Potential',
                 'personally_identifiable_information': 'Potential',
                 'sensitivity_of_data': 'High (credentials, unauthorized '
                                        'access)',
                 'type_of_data_compromised': 'Credentials, System Access'},
 'date_detected': '2025-10-01',
 'description': 'Kaspersky’s Managed Detection and Response (MDR) team '
                'uncovered a sophisticated cyberattack leveraging '
                'ScreenConnect, a legitimate remote monitoring tool, to deploy '
                'AsyncRAT malware. The campaign, active since October 2025, '
                'spans over 90 spoofed domains in 10 languages, targeting '
                'users worldwide through typosquatted websites impersonating '
                'popular software like OBS Studio, DNS Jumper, DS4Windows, and '
                'Bandicam.',
 'impact': {'data_compromised': 'Potential credential theft and unauthorized '
                                'access',
            'identity_theft_risk': 'High',
            'operational_impact': 'Long-term control over infected devices',
            'systems_affected': 'Windows systems with ScreenConnect and '
                                'AsyncRAT installed'},
 'initial_access_broker': {'backdoors_established': 'ScreenConnect, AsyncRAT',
                           'data_sold_on_dark_web': 'Potential',
                           'entry_point': 'Typosquatted websites, SEO '
                                          'manipulation'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Highlights risks of trusted remote tools and '
                    'typosquatting, underscoring the need for strict software '
                    'controls and outbound traffic monitoring.',
 'motivation': ['Credential Theft',
                'Unauthorized System Access',
                'Data Exfiltration'],
 'post_incident_analysis': {'corrective_actions': ['Enhance detection of '
                                                   'anomalous child processes',
                                                   'Monitor for suspicious MSI '
                                                   'package installations',
                                                   'Implement stricter '
                                                   'allowlisting for remote '
                                                   'tools'],
                            'root_causes': ['Abuse of legitimate remote access '
                                            'tools',
                                            'Typosquatting and SEO '
                                            'manipulation',
                                            'DLL sideloading and process '
                                            'hollowing techniques']},
 'recommendations': ['Implement strict software controls',
                     'Monitor outbound traffic',
                     'Disable or restrict use of remote access tools unless '
                     'necessary',
                     'Educate users on typosquatting risks'],
 'references': [{'source': 'Kaspersky MDR Investigation'}],
 'response': {'enhanced_monitoring': 'Anomalous child process detection, '
                                     'malware signature analysis',
              'third_party_assistance': 'Kaspersky’s Managed Detection and '
                                        'Response (MDR) team'},
 'title': 'Cybercriminals Exploit Legitimate Remote Access Tool in Large-Scale '
          'Malware Campaign',
 'type': 'Malware Campaign',
 'vulnerability_exploited': 'Legitimate remote access tool abuse '
                            '(ScreenConnect)'}