The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

This investigation details a global, multi-language campaign (Oct 2025–Mar 2026) where threat actors used SEO-boosted spoofed download sites to distribute archives that pair a legitimate signed installer with a malicious DLL (install.res.1033.dll); the DLL is used to sideload and silently install ScreenConnect as a remote access backdoor and to deploy AsyncRAT via reflective loading and process hollowing, enabling persistence, credential theft, and remote control. The report includes infrastructure mapping, numerous IoCs (domains, IPs, hashes), detection rules, and practical mitigation recommendations.