Roughly two out of every three pages Google cites in an AI Overview do not rank on page one for the query that triggered it.

Read that again if you run a Web3 site. It means the ranking you fought for last year and the citation you want this year are no longer the same prize.

The numbers behind that shift are not subtle. Zero-click searches on Google reached 68% in early 2026, up from about 45% a decade ago, according to SparkToro and Datos research. AI Overviews now appear on more than 20% of Google searches, and when one shows up, click-through rates on the results below it fall by close to 60%. Ahrefs and BrightEdge data from February 2026 puts the overlap between AI Overview citations and top-10 organic rankings somewhere between 17% and 38%, down from roughly 76% in mid-2024.

Meanwhile the audience keeps growing. Crypto.com’s Market Sizing Report counted 741 million global crypto owners at the end of 2025, a 12.4% increase over 2024. ChatGPT passed 800 million weekly active users in early 2026. A large share of the people who used to type “best staking platform” into Google are now asking an assistant instead, and the assistant answers without sending anyone anywhere.

So the job has changed. You are no longer competing for a blue link. You are competing to be the source a model reaches for.

The traffic math changed, and crypto sites got hit twice

Web3 sites carry two disadvantages into this. Most are single-page applications that render badly for crawlers, and most operate in a category Google treats as Your Money or Your Life, where trust signals weigh far more than they do for a recipe blog.

That combination is why so many well-funded protocols have decent Twitter engagement and almost no organic footprint.

Three consequences worth internalising:

• Rankings and citations are now separate outcomes. You can hold position three and never get quoted.
• Brand mentions and domain citations are also separate. Semrush’s 2026 AI Visibility Index, built on 126 million US prompts, found the overlap between mentioned brands and cited domains ranges from 64% on Google AI Overviews down to about 30% on Gemini.
• Traffic will keep falling even where visibility rises. Plan for a metric that is not sessions.

Build the entity before you build the content

Language models do not rank pages. They resolve entities, then look for evidence about them. If a model cannot confidently tell that your protocol, your company, and your token are the same organisation, nothing else you do will stick.

Start here.

Fix your name everywhere

Pick one canonical brand string and use it on the site, in the docs, on GitHub, on CoinGecko, on LinkedIn, and in every press release. Variant naming splits your entity into fragments.

Claim a Wikidata item

Wikidata is machine-readable and heavily ingested. A properly sourced item with founding date, headquarters, founders, and official website gives every model a clean anchor.

Ship Organization schema with sameAs

Your homepage should carry Organization markup listing every profile you control: X, LinkedIn, GitHub, CoinGecko, CoinMarketCap, Crunchbase. This is how you tell a parser that those scattered profiles belong to one thing.

Make founders and researchers real entities too

Author pages with credentials, prior roles, and links to conference talks or published papers do more for a crypto site than another 2,000-word explainer.

Fix the crawl layer that Web3 sites keep breaking

Nothing on this list is exotic. All of it is routinely broken on protocol sites.

Render server-side or pre-render. If your token page needs JavaScript to display the APY, Googlebot may eventually see it and most AI crawlers will not. Test with the URL Inspection tool in Google Search Console and with a plain curl request. If curl returns an empty div, you have a problem.

Decide about AI crawlers on purpose. GPTBot, OAI-SearchBot, PerplexityBot, ClaudeBot, and Google-Extended each obey robots.txt. Cloudflare began blocking AI crawlers by default for new domains in July 2025, so plenty of sites are blocking retrieval bots without knowing it. Check your edge settings, not just your robots file.

Keep documentation on your own domain. Docs hosted on a subdomain of a third-party platform build that platform’s authority, not yours.

Do not rely on IPFS-only hosting for content you want indexed. Gateway inconsistency and slow first-byte times will cost you.

Watch Core Web Vitals on wallet-connect pages. Heavy Web3 libraries push Interaction to Next Paint into failing territory faster than almost anything else.

Write pages that can be lifted, not just read

Extraction is the whole game now. A model scanning your page is looking for a passage it can quote with confidence and attribute cleanly.

Answer the question in the first 60 words of the section, then explain. Burying the answer under 400 words of context is how you lose a citation to a thinner competitor.

Keep passages self-contained. A paragraph that only makes sense after reading the previous four will not survive being chunked and embedded.

Put numbers in tables with units and dates. Fee comparisons, chain throughput, staking yields, and audit dates all extract better as structured rows than as prose.

Use Article, Organization, FAQPage, and BreadcrumbList schema. Google stopped showing FAQ rich results for most sites, but the markup still helps parsers segment your content. Schema.org and Google Search Central both document the current requirements.

Date everything visibly. In a category where a yield figure goes stale in a week, an undated page reads as untrustworthy to a human editor and to a model.

One more thing that matters more than people expect: write the definitional sentence you want quoted. “Restaking is the practice of reusing staked ETH to secure additional protocols” is a sentence a model can lift. A paragraph that circles the same idea is not.

Trust is the ranking factor in a YMYL category

Google’s Quality Rater Guidelines were revised in September 2025 with a new chapter on evaluating AI Overviews, and in February 2026 Google added an Authors section to Search Central documentation. Both point the same direction. Who wrote this, and why should anyone believe them.

For crypto content, that means concrete things:

• Named authors with verifiable backgrounds, not “Admin” or a team byline.
• Links to the actual audit reports, not a badge image.
• Risk disclosures on anything that touches yield, custody, or token purchase.
• Citations to primary sources: the whitepaper, the governance forum post, the on-chain data, the regulator’s own publication.
• A visible corrections policy and a changelog on evergreen pages.

The sites winning crypto citations in 2026 read like research desks. The ones losing read like marketing departments.

This is also where most in-house teams stall, because the work sits between engineering, legal, and content, and nobody owns all three. It is the reason a crypto AI SEO agency like Blockchain App Factory tends to get pulled in on the technical and entity side, where the fixes are unglamorous and the compliance constraints are real. Whoever does it, the sequencing is the same: entity first, crawl access second, content third.

Get cited where the models actually read

Your own site is one input. It is rarely the deciding one.

Reddit, Wikipedia, and YouTube sit at the top of citation share across every major AI surface. Contently’s 2026 analysis of the most-cited sources found Reddit and Wikipedia occupying the top slots on ChatGPT by a wide margin, with YouTube appearing in a large share of Google AI Overviews.

For crypto specifically, add the category-native sources that models trust for factual grounding:

• CoinGecko and CoinMarketCap for token and exchange data
• DefiLlama for TVL, chain metrics, and protocol revenue
• Messari and Dune for research and dashboards
• Etherscan and equivalent explorers for contract-level facts
• GitHub for repository activity and release history

Keep those listings accurate and complete. A wrong contract address on CoinGecko propagates into AI answers within days.

Then do the boring off-site work. Answer questions in the subreddits where your users actually are, without a link in the first comment. Get your protocol into comparison articles on independent research sites. Publish original data nobody else has, because original data is the only thing that reliably earns citations from sources you do not control.

Measure what you cannot see in Google Analytics

Search Console will not tell you whether ChatGPT quoted you. Build a second layer.

Segment referral traffic by source. Sessions from chatgpt.com, perplexity.ai, gemini.google.com, and claude.ai are small in volume and often high in intent. Track them separately and look at conversion rate, not sessions.

Run a fixed prompt set monthly. Pick 40 to 60 queries your buyers actually ask, run them across ChatGPT, Gemini, Perplexity, and Google AI Mode, and log whether you were mentioned and whether you were cited. Those are two different columns.

Watch branded search volume as a proxy. When AI answers push clicks down, branded search is often the only place growth still shows.

Semrush found that 45% of marketing leaders cannot accurately measure brand visibility in AI answers, and only 9% have tooling across every platform. Building even a crude tracker puts you ahead of most of the market.

A 90-day sequence

Days 1 to 30: audit rendering, unblock the AI crawlers you want, publish Organization and Article schema, create or correct your Wikidata item, and fix listings on CoinGecko, CoinMarketCap, and DefiLlama.

Days 31 to 60: rebuild your top 15 pages for extraction with answer-first sections, dated data tables, and named authors carrying real credentials. Add risk disclosures where they belong.

Days 61 to 90: publish one original data asset, seed genuine participation in two or three communities where your buyers gather, and stand up the monthly prompt tracker.

None of this is fast. Entity signals compound over quarters, which is exactly why the teams that started in 2025 are the ones getting quoted now.

Frequently asked questions

Does ranking on page one still matter for AI citations?

It helps but it no longer guarantees anything. Ahrefs and BrightEdge data from early 2026 shows only 17% to 38% of AI Overview citations come from top-10 pages, down from about 76% in mid-2024. Treat ranking and citation as two separate targets.

Should I block AI crawlers to protect my content?

Blocking retrieval bots like OAI-SearchBot or PerplexityBot removes you from the answers they generate. If you want AI visibility, allow them. Training-only bots such as Google-Extended are a separate decision.

Is llms.txt worth implementing?

No major AI platform has confirmed it uses llms.txt as a ranking or retrieval input. It costs almost nothing to add, so treat it as optional housekeeping rather than a priority.

How long does crypto SEO take to show results?

Technical fixes can move things in weeks. Entity and trust signals typically take two to three quarters, and YMYL categories move slower than most because the trust bar is higher.

What is the single highest-return fix for a Web3 site?

Server-side rendering. If crawlers cannot see your content without executing JavaScript, every other investment on this list is wasted.

---

Crypto SEO: The 2026 Guide to Ranking a Web3 Site in Search and in AI Answers was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

Google is changing its site reputation abuse enforcement in the EEA after EU scrutiny, reducing one search penalty risk for publishers.

The post Google Changes EU Spam Policy to Avert Antitrust Fine appeared first on TechRepublic.

Google is changing its site reputation abuse enforcement in the EEA after EU scrutiny, reducing one search penalty risk for publishers.

The post Google Changes EU Spam Policy to Avert Antitrust Fine appeared first on TechRepublic.

The best SEO tools aren't the ones with the most features. Here are the 8 I still renew in 2026, ranked by what actually survives a renewal. See the ranking.

The post The 8 Best SEO Tools I Still Renew In 2026, Ranked Honestly first appeared on Redmond Pie.

UPD 03.07.2026: added a package of rules and recommendations that help detect the described malicious activity for companies using our Kaspersky SIEM system.

Introduction

To access compromised systems, threat actors frequently abuse legitimate remote monitoring tools. At first glance, these utilities rarely raise red flags: they are signed with valid digital certificates, often allowlisted under corporate IT policies, and fully supported by OS vendors. However, they grant attackers the ability to harvest data from target devices, drop malware, and move laterally across the network.

During a recent investigation engagement, the Kaspersky Managed Detection and Response (MDR) team discovered the ScreenConnect remote access tool being leveraged to deploy and execute an AsyncRAT payload.

A deep dive into this single incident unraveled a massive campaign distributing malicious installer archives hosted on spoofed websites. These installers masquerade as popular software like OBS Studio, DNS Jumper, DS4Windows, Bandicam, and others. In total, we uncovered more than 90 domain names localized across 10 languages. The malicious archives bundle a legitimate, signed Microsoft install.exe binary alongside a rogue install.res.1033.dll library. It is loaded onto the device via DLL sideloading and deploys the ScreenConnect service, which awaits further instructions from the threat actors.

As a result, what initially appeared to be an isolated ScreenConnect incident served as the starting point for a full investigation into the threat actor’s C2 infrastructure. Every spoofed site we uncovered followed the exact same playbook: dropping a hidden ScreenConnect remote administration service under the guise of a legitimate software installer. This allowed the attackers to maintain control over compromised endpoints, with victims ranging from individual users to organizations.

We continue to break down complex, multi-stage incidents like this in our ongoing The SOC Files series. In this post, we take a deep dive into the technical execution of the ScreenConnect attack and analyze the broader infrastructure under the threat actor’s control.

Initial incident investigation

The investigation was triggered by an alert from Kaspersky MDR, which flagged the creation and execution of suspicious PowerShell and VBS scripts spawned by a ScreenConnect process.

About ScreenConnect

ScreenConnect is a legitimate remote management utility. Kaspersky solutions detect it as not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen.

ScreenConnect was running as an Access-type service — enabling direct remote connectivity — with the server explicitly passed via the command line:

Once running, ScreenConnect created and executed a PowerShell script named Fj5NmEsp9EuKrun.ps1:

Below is an excerpt from the contents of the script:

This script configures Microsoft Defender exclusions for the following objects:

• All disks in the system: C:\, D:\, and others
• All root directories on the C:\ drive, as well as the C:\Users\Public directory
• RegAsm.exe process

Additionally, the script disables User Account Control (UAC) prompts by setting the ConsentPromptBehaviorAdmin registry parameter to 0.

Following this setup, the ScreenConnect service goes on to create a VBScript file:

The installer_method3_stream.vbs script creates five files in the C:\Users\Public directory (msgbox.txt, secret_bytes.txt, 1.vb, cap.ps1, and script.vbs) and immediately triggers their execution by launching script.vbs.

This script terminates all active powershell.exe processes to cover its tracks and executes cap.ps1 in a hidden window.

cap.ps1 reads the contents of the secret_bytes.txt file, extracts sequences matching the [SXX- pattern, and converts XX from hexadecimal representation to a byte. It then uses a 0xA7 XOR key to decrypt each byte and inverts the bit order. The resulting byte array yields a fully formed PE binary, which is then reflectively loaded into the CLR.

Within the loaded assembly, the ConsoleApp1.Module1 type contains a static method named Run. The script uses reflection (Reflection.BindingFlags) to resolve a reference to this method and invoke it.

The Run method executes a process hollowing technique (T1055.012), spawning a new RegAsm.exe process with the CREATE_SUSPENDED flag. The deobfuscated and decrypted PE image from secret_bytes.txt is then copied into its address space. As a result, the RegAsm.exe process no longer executes its original code, instead serving as a container for the injected .NET module — which, in this case, is the AsyncRAT remote access Trojan.

To establish persistence, the malware schedules a task named MasterPackager.Updater:

"schtasks" /Create /TN "MasterPackager.Updater" /TR "wscript.exe "C:\Users\Public\script.vbs" " /SC MINUTE /MO 2 /F

This task triggers every two minutes, ensuring that script.vbs — and consequently the entire loader chain — executes even after a system reboot.

Once the entire infection chain successfully executes, the RegAsm.exe process establishes a connection to the C2 domain mora1987[.]work[.]gd.

How ScreenConnect entered the system

A retrospective analysis of the incident allowed us to pinpoint the source of the ScreenConnect installation: a user-downloaded archive named obs-studio-windows-x64.zip.

The archive was downloaded from hxxps://www.studioobs[.]com/, a typosquatted domain mimicking the official site for OBS Studio, a popular open-source screen recording app. This site is present in search engine results; in this specific incident, the user landed on the malicious domain directly from a search query, a vector we analyze in more detail below.

Clicking the download button for the supposedly legitimate software triggers a request to the following URL, from which the archive is fetched:

hxxps://fileget.loseyourip[.]com/obs-studio-windows-full/gVOMs5VZ9BtlcaM

The archive contains a legitimate, Microsoft-signed executable named install.exe (87603EA025623B19954E460ADD532048), renamed to masquerade as the OBS Studio installer, along with a malicious library named install.res.1033.dll. Additionally, the archive includes an Assets folder containing both a copy of the actual software being impersonated and the ScreenConnect utility.

The complete file structure of the archive is organized as follows:

When OBS-Studio-Installer.exe is executed, it loads install.res.1033.dll via DLL sideloading. This library contains the instructions required to install both ScreenConnect and OBS Studio. The deployment relies on native Windows utilities (msiexec.exe), but the attackers renamed the standard MSI packages to look like DLL files:

• Assets\x86\Data\vcredist_x64.dll: ScreenConnect installer
• Assets\x86\Data\vcredist_x86.dll: OBS Studio installer

The contents of the vcredist_x64.dll MSI package are shown below:

The Windows Installer is launched to install ScreenConnect silently in the background without requiring a system reboot:

msiexec.exe /i "C:\Temp\OBS-Studio-Windows-x64\Assets\x86\vcredist_x64.dll" /qn /norestart

Once the installation wraps up, a new service named Microsoft Update Service is created. The command line for this service explicitly defines the connection server as r[.]servermanagemen[.]xyz.

Meanwhile, the MSI package for the actual OBS Studio software runs using a standard graphical user interface.

Expanding the investigation

The attackers’ reliance on the legitimate install.exe binary provided a crucial pivot point for our broader investigation. We discovered that this specific file was being deployed in the wild under a variety of suspicious aliases, including:

• ds4windows.exe
• crosshairx_installer.exe
• obs-studio-installer.exe
• dns jumper.exe
• glary utilities pro.exe
• processhacker-2.39-setup.exe

These file names indicate that the threat actor was disguising their ScreenConnect archives as popular utilities beyond OBS Studio. Among the fakes, we identified counterfeit installers for DS4Windows, DNS Jumper, Glary Utilities, and Process Hacker. Crucially, when we search for these utilities on major search engines, these fraudulent sites frequently appear at the very top of the organic search results. This indicates that the threat actor is actively leveraging SEO techniques to boost traffic to their landing pages.

Spoofed software portals appearing in search engine results

For example, here is how the fraudulent download portal for DNS Jumper looks:

On this page, the download button directs users to the following address:

hxxps://direct-download.giize[.]com/dns-jumper/iopbsr4hymbo7nfa1q7j

Just like the OBS Studio variant, this drops an archive onto the victim’s device with an identical structure: a renamed legitimate install.exe file, a sideloaded library, and an Assets directory containing the promised software packaged alongside ScreenConnect.

Other fraudulent websites that appear in search engine results when querying the corresponding software are designed in a similar fashion.

Spoofed websites used to distribute ScreenConnect

Notably, the vast majority of the fraudulent sites we uncovered are localized into English, Russian, and Chinese. In several instances, the pages were also translated into German, French, Spanish, Arabic, and other languages. This multi-language support underscores the global footprint of the campaign, targeting a broad user base across multiple regions.

Fake domain infrastructure

To distribute ScreenConnect disguised as freeware, the threat actor spun up an extensive network of domain names mapped across three IP addresses. We have categorized these into two distinct infrastructure clusters.

Cluster 1: 162.216.241[.]242 and 198.23.185[.]81

```
162.216.241[.]242
Country: United States
Org name: Dynu Systems Incorporated
```

The connection graph below illustrates the campaign websites tied to IP address 162.216.241[.]242, which hosts the previously mentioned www[.]studioobs[.]com domain.

Looking into the registration dates for the domains on this IP, we found that the threat actor initially attempted to disguise their sites as various gaming portals:

Subsequently, starting in January 2026, they shifted strategy and began registering fake domains designed to mimic popular freeware:

In this specific branch of the ScreenConnect campaign, the malicious archives are hosted on fileget.loseyourip[.]com. Notably, the download resource is hosted on a completely separate provider:

```
198.23.185[.]81
Country: United States
Org name: NOHAVPS LLC
```

Our analysis of this second IP address revealed that it also hosts additional resources tied to the campaign, including fake gaming sites and supplementary download links:

Cluster 2: 2.59.134[.]97

```
2.59.134[.]97
Country: Germany
Org name: dataforest GmbH
```

Below is an infrastructure graph showing this IP address and its hosted domains. Notably, unlike the previous case, this address also hosts direct-download.giize[.]com, a resource used to store distributed malicious archives.

In this branch of the campaign, the threat actor skipped game-themed lures entirely, focusing exclusively on creating fraudulent freeware sites that bundled ScreenConnect with the requested application. The domains hosted on IP address 2.59.134[.]97 were registered between October 2025 and March 2026.

The chart below shows the volume of fraudulent websites created month by month:

Breakdown of ScreenConnect delivery sites by theme, August 2025 through March 2026 (download)

C2 infrastructure analysis

In total, we identified dozens of different archives distributed across this campaign. All of them share a uniform file structure, containing the malicious install.res.1033.dll library and the ScreenConnect MSI package located at Assets\x86\vcredist_x64.dll.

In some instances, the ScreenConnect installation package also bundles a CAB archive.

This archive contains a system.config XML file, which defines the connection address for the ScreenConnect C2 server:

By analyzing these ScreenConnect installations, we uncovered additional C2 addresses, which are mapped out in the following graph:

The next graph illustrates the AsyncRAT command-and-control infrastructure:

Based on the registration dates of the C2 domains, we can determine that the campaign was launched in October 2025 and paused at the end of March. However, at the time of publication, many of the landing pages remain accessible via search engine results.

Takeaways

Investigating a single case of AsyncRAT delivered via ScreenConnect allowed us to uncover a massive, multi-domain, multi-language infrastructure designed to distribute a hidden installer for this software and further advance the attack. The threat actor disguises ScreenConnect as popular utilities and distributes it through fraudulent websites that mimic official product pages. The attackers leverage search engine optimization techniques to push these sites to the top of search results in engines like Google and Bing.

This attack chain targets both everyday consumers downloading free software from the internet and corporate networks, where remote access tools are frequently allowlisted and granted elevated privileges.

The potential objective of the campaign is to steal credentials en masse and gain unauthorized access to systems for subsequent resale on dark web marketplaces.

To mitigate the risks associated with this threat, we recommend implementing the following security measures:

• Enforce strict software installation controls: application allowlisting and blocking MSI package execution from untrusted sources
• Continuously monitor for the creation of new remote administration services and scheduler tasks
• Filter outbound traffic to unknown domains and IP addresses
• Regularly train users on safe downloading practices
• Verify the authenticity of all software sources

For enterprise users, credential monitoring is a critical mitigation strategy against the risks detailed in this article, as a leaked account or compromised system access frequently serves as a vector for subsequent attacks on the organization.  Kaspersky Digital Footprint Intelligence provides continuous data monitoring across open and dark web sources, enabling security teams to respond proactively to potential threats.

Detection by Kaspersky solutions

Kaspersky Managed Detection and Response detects the malicious activity described in this post using the following indicators of attack:

1. ScreenConnect service creation with suspicious parameters
   

   logsource:                      
       product: windows         
       category: security
   detection:
       selection_access:
           EventID: 4697
           Service File Name|contains:
               - 'e=Access'
               - 'ClientService.exe'
       selection_support:
           EventID: 4697
           Service File Name|contains:
               - 'e=Support'
               - 'ClientService.exe'
       condition: selection_access or selection_support

2. Anomalous child processes being spawned by the ScreenConnect service
   

   logsource:
       product: windows
       category: process_creation
   detection:
       selection:
           ParentImage|endswith:
               - '\\ScreenConnect.ClientService.exe'
               - '\\ScreenConnect.WindowsClient.exe'
               - '\\ScreenConnect.WindowsBackstageShell.exe'
               - '\\ScreenConnect.WindowsFileManager.exe'
           Image|endswith:
               - '\\powershell.exe'
               - '\\cmd.exe'
               - '\\net.exe'
               - '\\schtasks.exe'
               - '\\sc.exe'
               - '\\msiexec.exe'
               - '\\mshta.exe'
               - '\\rundll32.exe'
       condition: selection

Additionally, Kaspersky products detect the malware covered in this post under the following verdicts:

• Trojan.Win64.DLLhijack.*
• Trojan.VBS.Agent.*
• Trojan.PowerShell.Agent.bav
• Trojan.JS.SAgent.sb

Endpoint malicious activity can be monitored using Kaspersky EDR Expert. Specifically, security teams should look for the execution of commands and scripts containing suspicious patterns, such as XOR operations used for command and data obfuscation by malware operating on the host. This activity is flagged by the suspicious_assembly_loading_into_powershell_via_reflection_amsi and xored_powershell_command_amsi rules.

Additionally, persistence mechanisms involving the creation, modification, or utilization of scheduled tasks via the schtasks.exe utility are caught by the scheduled_task_create_from_public_directory_via_schtasks rule.

Malicious code injection into the RegAsm.exe process — leveraged by attackers to masquerade execution behind a trusted system component — is detected via the code_injection_to_unusual_process rule.

To visualize the stages of the attack, security teams can utilize Kaspersky Cloud Sandbox on the Threat Intelligence portal. For instance, this tool allows defenders to map out the entire deployment and payload execution chain originating from the initial VBS dropper.

Furthermore, the Kaspersky Threat Intelligence portal supports searching and graphing the connections between malicious domains and files involved in this campaign, as demonstrated in our adversary infrastructure analysis section.

Finally, the Similarity engine within Kaspersky Threat Analysis profiles file contents to hunt down samples resembling the original threat, helping organizations identify new or previously undetected malicious objects.

To protect companies using our Kaspersky SIEM system, there are rules available in the product repository to help detect this type of malicious activity.

• Adding exclusions to Windows Defender scans via the registry is detected by rule R241_Modification of Windows Defender exclusions through the registry. Adding exclusions via PowerShell (Add-MpPreference -ExclusionPath|ExclusionProcess) is detected by rule R076_04_Windows Defender settings disabled or changed via PowerShell.
• Bypassing the UAC mechanism by modifying the ConsentPromptBehaviorAdmin registry key is detected by rule R242_UAC disabled through the Windows registry.
• Running VBS scripts from a public directory triggers rule R290_07_Running VBScript files from shared folders.
• Creating a scheduled task that runs an executable file from a public directory triggers rule R099_01_Scheduled task started from a public folder.

For the rules to function correctly, it is necessary to configure event 4657 (Security) audit for the following registry keys:

• HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
• HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Procesess
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin

Additionally, when developing your own detection rules or conducting threat hunting for suspicious ScreenConnect behavior, we recommend monitoring the following events:

• Creation of the ScreenConnect service with suspicious parameters
  

  DeviceEventClassID = '4697' 
  AND FileName LIKE '%ClientService.exe%' 
  AND (FileName LIKE '%e=Access%' OR FileName LIKE '%e=Support%')

• Launch of atypical child processes from the ScreenConnect service
  

  DeviceEventClassID = '4688'
  AND match(SourceProcessName, '.*\\\\ScreenConnect\\.(ClientService|WindowsClient|WindowsBackstageShell|WindowsFileManager)\\.exe')
  AND match(DestinationProcessName, '.*\\\\(powershell|cmd|net|schtasks|sc|msiexec|mshta|rundll32)\\.exe')

Indicators of compromise

Loaders

B32810973132D11AFD61CCEE222BBB79
5B7E1FE55BD7B5EA54BD4ED1677E5A26
9A9CCD8B0E5D05F4EE77667B024844DB
0EEE9BAD07E22415439E854657FA1366
8F4E8B680D3E8D3F5AC39BD72882F713

Malicious library: install.res.1033.dll

5F96C04E3AFAE97017B201BE112284D2
73BEAD922109A61E5F9F85771A7812C5
EDFF4F58722C93D7C09ED71899416396
83601C3D4ED28E8D2BE1B99BEB8EC18C
695E794631EF130583368770E7B81E98
83601C3D4ED28E8D2BE1B99BEB8EC18C
1E6A5C7B620D487D0CFC6874C3B77C90
54025CE2A9405039899FE99A1D77E0BB
BD05FCF80E493CF9AA71EC510319469D
999A63730C9634481D1D76955A2E76A8
479BD3BB617B39CD4A46D0768A2592D4
776DFD3DF9C04BB9FCDD6C1880C3761A
8E4C57358A66EB14D31ABB614DDC68DE
A40D3AEB0DAE5B00BDB3A517F3135BBB
A85A5BFDCB7C65AB93043B8CF9E20065
01325880EFFFEC546F59490089A3B415

AsyncRAT C2

mora1987[.]work[.]gd

Fake websites addresses

ds4windows[.]io
direct-download[.]giize[.]com
tmodloader[.]org
tmodloader[.]app
ds4windows[.]net
losslessscaling[.]app
processhacker[.]dev
steamtools[.]pro
dnsjumper[.]app
free-download[.]camdvr[.]org
defendercontrol[.]org
dns-jumper[.]com
cpuz[.]app
processhacker[.]org
processhacker[.]app
steamtools[.]cc
cpuz[.]pro
wallpaper-engine[.]app
processhacker[.]net
antimicrox[.]net
defendercontrol[.]app
tmodloader[.]pro
dnsjumper[.]io
bandicam[.]app
mgba[.]app
dnsjumper[.]pro
ferdium[.]app
ds4windows[.]pro
lossless-scaling[.]online
defender-control[.]com
gom-player[.]app
defendercontrol[.]pro
lossless-scaling[.]download
antimicrox[.]pro
mgba[.]pro
lossless-scaling[.]app
losslessscaling[.]pro
mgba[.]dev
tmodloader[.]download
tmod-loader[.]com
defendercontrol[.]download
ferdium[.]pro
deadreset[.]com
gom-player[.]net
crosshairx[.]pro
libreoffice[.]pro
studioobs[.]com
studio-obs[.]net
crosshairxv2[.]com
km-player[.]com
corel-draw[.]net
glary-utilities[.]com
download-full-version[.]ooguy[.]com
crosshair-x[.]com
kms-tools[.]com
studio-obs[.]com
crosshairx[.]net
clair-obscur-33[.]com
vlc-player[.]net
arksurvival-ascended[.]com
elden-ringnightreign[.]com
ready-ornot[.]com
arma-reforger[.]com
crusader-kings[.]com
crosshairx2[.]com
mediaplayerclassic[.]net
bandizip[.]pro
obs-studio[.]site
ovr-advanced-settings[.]com
studio-obs[.]pro
vlc-media[.]com
clair-obscur-33[.]town
ovr-toolkit[.]com
crusader-kings[.]church
bandizip[.]net
apexlegends[.]org
obs-studio[.]pro
vlc-media[.]net
crosshairx[.]site
monster-hunterwilds[.]com
km-player[.]pro
mediaplayerclassic[.]pro
kms-tools[.]net
fernbus-simulator[.]com
studioobs[.]pro
bandicam[.]cc
crystaldiskmark[.]cc
crystaldiskmark[.]io
crystaldiskmark[.]dev
crystaldiskmark[.]app
crystaldiskmark[.]pro
bandicam[.]io

Fake domain infrastructure

fileget.loseyourip[.]com
file-download-crosshairx.giize[.]com
all-toll-free.loseyourip[.]com
mpc-update.giize[.]com
all-toll-free.publicvm[.]com
198.23.185[.]81
direct-download.giize[.]com

ScreenConnect C2

servermanagemen[.]xyz
185.254.97[.]249
r.manage-server[.]xyz
45.145.41[.]205
winservec[.]net
manageserver[.]xyz
cloudsynn[.]com
pingserv[.]pro
ehostservers[.]xyz
serverdnsplan[.]net
pingpanl[.]pro
managedevice[.]xyz
edgeserv[.]ru