THREAT OPS › Threat News › The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/06/01082525/soc-files-screenconnect-featured-image-990x400.jpg" width="990" /></p><p><a href="https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/#SIEM">UPD 03.07.2026: added a packa
MITRE ATT&CK techniques
- Scheduled TaskT1053.005
- Digital CertificatesT1596.003
- IP AddressesT1590.005
- Digital CertificatesT1588.004
- Digital CertificatesT1587.003
- Remote Access ToolsT1219
- Process InjectionT1055
- Search EnginesT1593.002
- Malicious LibraryT1204.005
- PowerShellT1059.001
- Data ObfuscationT1001
- Process HollowingT1055.012
- CredentialsT1589.001
- Hidden WindowT1564.003
- Service ExecutionT1569.002
Indicators of compromise
- 87603ea025623b19954e460add532048md5
- b32810973132d11afd61ccee222bbb79md5
- 5b7e1fe55bd7b5ea54bd4ed1677e5a26md5
- 9a9ccd8b0e5d05f4ee77667b024844dbmd5
- 0eee9bad07e22415439e854657fa1366md5
- 8f4e8b680d3e8d3f5ac39bd72882f713md5
- 5f96c04e3afae97017b201be112284d2md5
- 73bead922109a61e5f9f85771a7812c5md5
- edff4f58722c93d7c09ed71899416396md5
- 83601c3d4ed28e8d2be1b99beb8ec18cmd5
- 695e794631ef130583368770e7b81e98md5
- 1e6a5c7b620d487d0cfc6874c3b77c90md5
- 54025ce2a9405039899fe99a1d77e0bbmd5
- bd05fcf80e493cf9aa71ec510319469dmd5
- 999a63730c9634481d1d76955a2e76a8md5
- 479bd3bb617b39cd4a46d0768a2592d4md5
- 776dfd3df9c04bb9fcdd6c1880c3761amd5
- 8e4c57358a66eb14d31abb614ddc68demd5
- a40d3aeb0dae5b00bdb3a517f3135bbbmd5
- a85a5bfdcb7c65ab93043b8cf9e20065md5
- 01325880efffec546f59490089a3b415md5
- https://www.kaspersky.com/enterprise-security/managed-detection-and-response?icid=gl_sl_mdr-lnk_sm-team_195a10e9872df951url
- https://www.studioobs.com/url
- https://fileget.loseyourip.com/obs-studio-windows-full/gVOMs5VZ9BtlcaMurl
- https://direct-download.giize.com/dns-jumper/iopbsr4hymbo7nfa1q7jurl
- https://www.kaspersky.com/go/kasap-en?icid=gl_sl_post-kasap-lnk_sm-team_31941f6708a4db08url
- https://dfi.kaspersky.com?icid=gl_sl_dfi-lnk_sm-team_99639c2452ebbd18url
- https://www.kaspersky.com/enterprise-security/endpoint-detection-response-edr?icid=gl_sl_post-kedr-expert_sm-team_29dc1130f3f612f2url
- https://tip.kaspersky.com/landscape/hunts/386240d5-9795-4b74-82fa-48c91c4332d6?icid=gl_sl_tip-rule-lnk_sm-team_ee84a77d9cb2a726url
- https://tip.kaspersky.com/landscape/hunts/65014132-dd3b-4a2e-abbf-9d26c4357e7c?icid=gl_sl_tip-rule-lnk_sm-team_9061a1c6dc8ec18eurl
- https://tip.kaspersky.com/landscape/hunts/86888af0-8f7f-4537-a3c8-45fa235ff11c?icid=gl_sl_tip-rule-lnk_sm-team_73520d105fc2c87eurl
- https://tip.kaspersky.com/landscape/hunts/f6798e4d-b911-3754-f7aa-b4f5af4b3d18?icid=gl_sl_tip-rule-lnk_sm-team_af0738664cd6b4cdurl
- https://www.kaspersky.com/enterprise-security/threat-analysis?icid=gl_sl_threat-analysis-lnk_sm-team_ac4d6b2bf27709ddurl
- https://www.kaspersky.com/enterprise-security/threat-intelligence?icid=gl_sl_post-ti_sm-team_338ad9481e2ccc25url
- https://www.kaspersky.com/enterprise-security/unified-monitoring-and-analysis-platform?icid=gl_sl_siem-inpost-link_sm-team_c6da27b0f60ba483url
- https://opentip.kaspersky.com/b32810973132d11afd61ccee222bbb79/results?icid=gl_sl_tr-post-opentip_sm-team_3c257a3056392811&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/5b7e1fe55bd7b5ea54bd4ed1677e5a26/results?icid=gl_sl_tr-post-opentip_sm-team_9fb1d1d79cd06c80&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/9a9ccd8b0e5d05f4ee77667b024844db/results?icid=gl_sl_tr-post-opentip_sm-team_b14c2f659639c05a&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/0eee9bad07e22415439e854657fa1366/results?icid=gl_sl_tr-post-opentip_sm-team_3c86c79b0aa7c325&utm_source=SL&utm_medium=SL&utm_campaign=SLurl
- https://opentip.kaspersky.com/8f4e8b680d3e8d3f5ac39bd72882f713/results?icid=gl_sl_tr-post-opentip_sm-team_7b8adf9251c64f62&utm_source=SL&utm_medium=SL&utm_campaign=SLurl