The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign

Securelist

July 1, 2026 at 10:00 AM

Actively Exploited

Overview

Kaspersky researchers have identified a large-scale campaign that uses compromised ScreenConnect software to deliver AsyncRAT, a type of remote access Trojan. Attackers are exploiting vulnerabilities in the legitimate ScreenConnect application to drop the malicious payload onto targeted systems. This incident raises concerns for users and organizations that rely on ScreenConnect for remote access, as they may unknowingly become victims of this malware. The report details the infection chain and the command and control (C2) infrastructure used in the attack, emphasizing the need for vigilance in software downloads and updates. Users should ensure they are downloading software from official sources and remain cautious of unsolicited software offers.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: ScreenConnect software, AsyncRAT
Action Required: Users should ensure they download ScreenConnect from official sources and apply any available security updates.
Timeline: Newly disclosed

Original Article Summary

Kaspersky experts have uncovered a malicious network infrastructure for delivering AsyncRAT. The Trojan is dropped via compromised ScreenConnect software. In this post, we break down the infection chain and analyze the C2 infrastructure.

Impact

ScreenConnect software, AsyncRAT

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should ensure they download ScreenConnect from official sources and apply any available security updates. Regularly monitor systems for unusual activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, Trojan, Kaspersky.

Read Original Article

Related Coverage

Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands

The Hacker News

Researchers at Cato AI Labs have identified two serious vulnerabilities in Cursor, an AI code editor. These flaws, named DuneSlide and tracked as CVE-2026-50548 and CVE-2026-50549, could allow an attacker to bypass the editor's safety sandbox using a seemingly harmless prompt. This means that any command could potentially be executed on a developer's computer without requiring any user interaction, such as clicks or approvals. With a severity rating of 9.8 out of 10, these vulnerabilities pose a significant risk to developers using Cursor. It is crucial for users to remain vigilant and consider the implications of these flaws on their systems and data security.

Jul 1, 2026

Fake Interpol Investigation Emails Push Ransomware at Small Businesses Globally

Hackread – Cybersecurity News, Data Breaches, AI and More

Small businesses are facing a new threat from fake emails that appear to come from Interpol. These emails contain links to Proton Drive, which, when clicked, deliver ransomware to victims' systems. The ransomware encrypts files, effectively locking businesses out of their data. Additionally, the malware directs users to Tox chat, which may facilitate further malicious activity. This incident is particularly concerning as it targets smaller companies that may lack robust cybersecurity measures, making them more vulnerable to such attacks. Businesses need to be vigilant about phishing attempts and ensure they have adequate protections in place.

Jul 1, 2026

How I stopped a massive WordPress spam attack with 4,700 lines of code in two days - thanks to Codex and Claude

CISA Warns BlueHammer Flaw Is Now Exploited in Ransomware Attacks

Security Affairs

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that the BlueHammer vulnerability, identified as CVE-2026-33825, is now being exploited in ransomware attacks. This flaw allows attackers to escalate privileges within Microsoft Defender, potentially giving them SYSTEM-level access. Initially, BlueHammer was just a proof-of-concept, but it has now transitioned into a real threat actively being used by cybercriminals. Organizations using Microsoft Defender should be particularly vigilant as this vulnerability poses a significant risk to their security posture. Immediate action is required to mitigate the potential impacts of these ransomware attacks as they become more widespread.

Jul 1, 2026

Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack

SecurityWeek

Citrix has announced security patches for its NetScaler product, addressing six vulnerabilities that could pose risks to users. Among these is a severe flaw known as the 'HTTP/2 Bomb', which can lead to system crashes under certain conditions. Additionally, a CitrixBleed-style bug has been identified, which could allow unauthorized information disclosure. Citrix is urging all customers using NetScaler to apply these patches as soon as possible to mitigate potential exploitation. The vulnerabilities underscore the importance of maintaining up-to-date security measures, especially for widely used enterprise solutions like NetScaler.

Jul 1, 2026

Anthropic's Fable 5 and Mythos 5 Are Back with New Security Guardrails

Infosecurity Magazine

Anthropic has introduced new security features in its language models, Fable 5 and Mythos 5, aimed at addressing vulnerabilities related to AI jailbreak techniques. These vulnerabilities were significant enough to prompt U.S. export controls. The latest updates include a new classifier that effectively blocks these jailbreak attempts in over 99% of cases. This is crucial because it helps prevent misuse of AI technologies, which could lead to the generation of harmful or misleading content. As AI systems become more integrated into various applications, ensuring their security against exploitation is increasingly important for both developers and users.

Jul 1, 2026