AsyncRAT and ScreenConnect C2 communication to r.servermanagemen.xyz / mora1987.work.gd

Duo Tech@duotech

•updated Jul 2, 2026•0•0•3

Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.