AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories

This report documents a sustained 2024–2025 campaign abusing trojanized ConnectWise ScreenConnect and ClickOnce-style installers to deliver AsyncRAT and a custom PowerShell RAT via open directories and phishing redirect chains; it enumerates multiple infrastructure hosts and domains, file- and container-hash IOCs, dual execution paths (in-memory .NET load vs native DLL injection via libPK.dll), aggressive persistence (scheduled tasks), port/TLS-based C2 tradecraft, and provides detection and mitigation guidance.