Loading story…
Researchers reported that Operation SilentCanvas is using weaponized .jpeg files to compromise Windows systems and deploy a trojanized ConnectWise ScreenConnect remote access tool. In the campaign, a file such as sysupdate.jpeg is actually a PowerShell loader delivered through social engineering, including phishing, deceptive file-sharing, and fake software updates. The malware creates a staging directory at C:\Systems, downloads additional payloads from legitserver.theworkpc[.]com over TCP port 5443, and compiles a custom launcher named uds.exe on the victim host using csc.exe.
The intrusion chain includes runtime string reconstruction, in-memory execution of a secondary payload, AMSI bypass, and a UAC bypass that abuses the ms-settings registry path and launches ComputerDefaults.exe to gain elevated privileges without a visible prompt. Once installed, the malware enables persistent remote access, credential theft, encrypted command-and-control, screen capture, microphone monitoring, hidden desktop execution, and long-term persistence through a Windows service named OneDriveServers and hidden administrator accounts. Defenders were urged to monitor abused Windows binaries, investigate suspicious PowerShell and unexpected ScreenConnect activity, tightly control remote administration tools, isolate affected hosts, and reset privileged credentials after suspected compromise.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Symantec publicly reported that the early-2026 intrusions were linked to Seedworm and described the group's use of legitimate signed binaries, attacker-controlled infrastructure, and public file-transfer services for espionage and data exfiltration.
Cyfirma disclosed that the SilentCanvas intrusion chain downloads a trojanized ConnectWise ScreenConnect package, compiles a custom launcher on the victim host, bypasses AMSI and UAC, and establishes long-term persistence through a Windows service and hidden administrator accounts.
By May 2026, Cyfirma analyzed a campaign dubbed Operation SilentCanvas in which attackers used a weaponized file named sysupdate.jpeg, actually a PowerShell loader, to compromise Windows systems through likely phishing, deceptive file-sharing, or fake software updates.
In February 2026, Seedworm breached a major South Korean electronics manufacturer for roughly one week, using DLL sideloading, Node.js-based loaders, PowerShell, credential theft tools, privilege escalation tooling, and screenshot capture to maintain access and collect intelligence.
In early 2026, the Iran-linked group Seedworm carried out an espionage campaign affecting at least nine organizations in nine countries across four continents, targeting sectors including manufacturing, government, education, financial services, and professional services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurity.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026
Huntress identified a campaign in which attackers use social engineering—including fake technical support, phishing, fraudulent refund-search results, and Quick Assist abuse—to persuade victims to install trojanized ConnectWise ScreenConnect clients. Rather than exploiting a ScreenConnect vulnerability, the altered remote-support software detects incoming sessions and uses ScreenConnect file-transfer and remote-execution functions to send a staged four-part VBScript loader to the connecting endpoint, potentially infecting technician and help-desk systems without further user interaction. The payload chain profiles hosts, establishes persistence, seeks elevated execution, and can deploy remote-access, tunneling, and cryptocurrency-mining tools while attempting to evade security controls, including Microsoft Defender reporting and User Account Control. Huntress observed the activity at unrelated organizations during late-August incidents and advises organizations to reimage confirmed compromised systems, review ScreenConnect deployments and audit logs, and investigate suspicious Windows Script Host or PowerShell execution linked to ScreenConnect sessions.
Sep 8, 2026
Elastic Security Labs identified **SILENTCONNECT**, a previously undocumented .NET loader used in active invitation-themed phishing campaigns to install ConnectWise ScreenConnect and give attackers remote control of compromised Windows systems. Victims are routed through Cloudflare Turnstile CAPTCHA pages to download a VBScript, which uses PowerShell and `curl.exe` to retrieve C# payload code from Google Drive and compile it in memory with .NET `Add-Type`. SILENTCONNECT attempts to evade detection by using native APIs, masquerading its process through the Process Environment Block (PEB) as `winhlp32.exe`, bypassing UAC through the `CMSTPLUA` COM interface, and adding a Microsoft Defender exclusion for `.exe` files. It silently installs an attacker-configured ScreenConnect MSI that persists as a service and connects to attacker-controlled infrastructure; related activity has also delivered preconfigured ScreenConnect and Syncro RMM installers through counterfeit DocuSign and Microsoft Teams pages.
Sep 9, 2026