Cryptojacking via ScreenConnect - Anomalous Beacon to directdownload.icu

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•10

Identifies the ScreenConnect Client Service initiating network traffic to the domain 'directdownload.icu', which has been associated with cryptojacking campaigns. This activity indicates potential compromise and resource hijacking.