RST TI Report Digest: 06 Jul 2026

**Executive summary:** Researchers uncovered a large-scale campaign that abuses legitimate ScreenConnect remote-access installers and typosquatted download sites to sideload and inject AsyncRAT (via DLL sideloading and process hollowing), establish persistence with scheduled tasks, and connect to clustered C2 infrastructure — the report provides extensive IOCs (IPs, ~90+ typosquatted domains, URLs, and multiple file hashes) and notes likely credential theft and ongoing remote control.