---
id: 6218
title: "AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories"
source_domain: hunt.io
source_url: "https://hunt.io/blog/asyncrat-screenconnect-open-directory-campaigns"
published_at: "2025-09-18T00:00:00Z"
tags: ["ai-security", "malware", "persistence", "screenconnect", "open-directory", "asyncrat", "hunt-io", "rmm", "security-news"]
phying_url: "https://phying.com/item/6218"
lang: en
---

# AsyncRAT Campaigns Uncovered: How Attackers Abuse ScreenConnect and Open Directories

## Summary

ConnectWise ScreenConnect installers were trojanized to deliver AsyncRAT from at least eight hosts, with payloads unseen on VirusTotal, ClickOnce /Bin/ pivots and scheduled-task persistence.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-09-18T00:00:00Z
- **Original:** https://hunt.io/blog/asyncrat-screenconnect-open-directory-campaigns
- **Phying News:** https://phying.com/item/6218