Malware

SILENTCONNECT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

The primary initial access vector for these campaigns starts from phishing emails. We identified an email sample ( YOU ARE INVITED.eml ) uploaded to VirusTotal from a campaign last year.

T1566.002Spearphishing LinkEvidence1

The primary initial access vector for these campaigns starts from phishing emails... [the email] invites the recipient to submit a proposal by clicking a link. This link redirects the victim to attacker-controlled infrastructure.

Execution

3 techniques

T1059.001PowerShellEvidence2

The script de-obfuscates to... powershell.exe -ExecutionPolicy Bypass... Add-Type... [HelloWorld]::SayHello().

T1059.005Visual BasicEvidence1

After clicking the human verification checkbox, a VBScript file (E-INVITE.vbs) is downloaded to the machine.

T1106Native APIEvidence2

SILENTCONNECT... allocates executable memory using... NtAllocateVirtualMemory... [and] uses NTAPIs from ntdll.dll... enabling the malware to invoke functions such as NtWriteVirtualMemory... directly from .NET.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence2

Before launching the payload, the malware implements a UAC bypass... If the malware is in an un-elevated state, it will attempt to use the UAC bypass technique via CMSTPLUA COM interface.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence2

The VBScripts are minimally obfuscated... employ the Replace() and Chr() functions to hide the next stage. The retrieved C# source code uses... constant unfolding... Launch parameters are stored in a character array in reverse order.

T1036MasqueradingEvidence2

SILENTCONNECT implements... PEB masquerading... overwrites its BaseDLLName and FullDllName to winhlp32.exe and c:\windows\winhlp32.exe.

T1620Reflective Code LoadingEvidence1

PowerShell command compiles the downloaded C# source... at runtime using Add-Type, loads it into memory as a .NET assembly, and executes it via the [HelloWorld]::SayHello() method.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence2

This snippet uses PowerShell to invoke curl.exe to download a C# payload from Google Drive... SILENTCONNECT... uses curl.exe to download the malicious ScreenConnect client installer.

T1219Remote Access ToolsEvidence1

The final payload observed in these campaigns is ScreenConnect, a remote monitoring and management (RMM) tool used to control victim machines.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

The first part of this obfuscated command adds a Microsoft Defender exclusion for .exe files... Add-MpPreference -ExclusionExtension $s -Force.

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 days ago

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app7 months ago

ip.v4●●●●●●●●●●●●View more in app7 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

elastic security labsNews

Mar 19, 2026

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

A .NET loader delivered through phishing and a multi-stage VBScript/PowerShell infection chain. It downloads and silently installs a maliciously configured ScreenConnect client, performs PEB masquerading, uses NT APIs, attempts a CMSTPLUA COM-based UAC bypass, and adds a Microsoft Defender exclusion for .exe files.

elastic security labsNews

Mar 4, 2026

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect - Elastic Security Labs

A newly discovered .NET loader that downloads and silently installs ConnectWise ScreenConnect for hands-on-keyboard access. It uses NT API calls, PEB masquerading, Windows Defender exclusion creation, and a UAC bypass via the CMSTPLUA COM interface to evade detection and elevate privileges.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

SILENTCONNECT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

The primary initial access vector for these campaigns starts from phishing emails. We identified an email sample ( YOU ARE INVITED.eml ) uploaded to VirusTotal from a campaign last year.

T1566.002Spearphishing LinkEvidence1

Execution

3 techniques

T1059.001PowerShellEvidence2

The script de-obfuscates to... powershell.exe -ExecutionPolicy Bypass... Add-Type... [HelloWorld]::SayHello().

T1059.005Visual BasicEvidence1

After clicking the human verification checkbox, a VBScript file (E-INVITE.vbs) is downloaded to the machine.

T1106Native APIEvidence2

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence2

Before launching the payload, the malware implements a UAC bypass... If the malware is in an un-elevated state, it will attempt to use the UAC bypass technique via CMSTPLUA COM interface.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence2

T1036MasqueradingEvidence2

SILENTCONNECT implements... PEB masquerading... overwrites its BaseDLLName and FullDllName to winhlp32.exe and c:\windows\winhlp32.exe.

T1620Reflective Code LoadingEvidence1

PowerShell command compiles the downloaded C# source... at runtime using Add-Type, loads it into memory as a .NET assembly, and executes it via the [HelloWorld]::SayHello() method.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence2

This snippet uses PowerShell to invoke curl.exe to download a C# payload from Google Drive... SILENTCONNECT... uses curl.exe to download the malicious ScreenConnect client installer.

T1219Remote Access ToolsEvidence1

The final payload observed in these campaigns is ScreenConnect, a remote monitoring and management (RMM) tool used to control victim machines.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence2

The first part of this obfuscated command adds a Microsoft Defender exclusion for .exe files... Add-MpPreference -ExclusionExtension $s -Force.

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app4 days ago

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app7 months ago

ip.v4●●●●●●●●●●●●View more in app7 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

elastic security labsNews

Mar 19, 2026

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

elastic security labsNews

Mar 4, 2026

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect - Elastic Security Labs

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.