Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories

hunt.io | blog | #malware | #persistence | #screenconnect | #open-directory | #asyncrat | #rmm

Summary

ConnectWise ScreenConnect installers were trojanized to deliver AsyncRAT from at least eight hosts, with payloads unseen on VirusTotal, ClickOnce /Bin/ pivots and scheduled-task persistence.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Exposed BYOB C2 Infrastructure Reveals a Multi-Stage Malware Deployment
A live BYOB C2 open directory revealed a multi-stage deployment: droppers, stagers and post-exploitation modules for Windows, Linux and macOS, seven persistence mechanisms, plus XMRig miners.
blog · wiz.io
Three’s a Crowd: TeamPCP trojanizes LiteLLM in Continuation of Campaign
TeamPCP trojanized LiteLLM with malicious PyPI versions 1.82.7 and 1.82.8: the payloads abuse Python's .pth mechanism to run base64 payloads at startup, exfiltrating cloud and CI/CD credentials.
blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged
An exposed Hong Kong staging server revealed Hermes, an autonomous AI agent run unattended, an unreported Go implant named Hades, and tooling targeting Thailand's Ministry of Finance.
blog · hunt.io
Open Directory Stages NGINX Rift and Ghost CMS Exploits Against Government and Finance Across Eleven Countries
An exposed open directory reveals an operator staging NGINX Rift, Ghost CMS, and other recent CVEs against government and finance, using DNS callbacks to verify execution.
blog · hunt.io
Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server
Hunt.io AttackCapture found Ababil of Minab's staging server wide open: 5 GB of victim data including LA Metro SCADA backups and Israeli organizations' credentials, configs, and database dumps.
back