Loading story…
Elastic Security Labs identified SILENTCONNECT, a previously undocumented .NET loader used in active invitation-themed phishing campaigns to install ConnectWise ScreenConnect and give attackers remote control of compromised Windows systems. Victims are routed through Cloudflare Turnstile CAPTCHA pages to download a VBScript, which uses PowerShell and curl.exe to retrieve C# payload code from Google Drive and compile it in memory with .NET Add-Type.
SILENTCONNECT attempts to evade detection by using native APIs, masquerading its process through the Process Environment Block (PEB) as winhlp32.exe, bypassing UAC through the CMSTPLUA COM interface, and adding a Microsoft Defender exclusion for .exe files. It silently installs an attacker-configured ScreenConnect MSI that persists as a service and connects to attacker-controlled infrastructure; related activity has also delivered preconfigured ScreenConnect and Syncro RMM installers through counterfeit DocuSign and Microsoft Teams pages.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
SILENTCONNECT, a .NET loader used to deploy remote-management tools, reportedly remained under the radar beginning in March 2025. The campaigns primarily used invitation-themed phishing emails to initiate infections.
Elastic Security released the YARA rule Windows_Trojan_SilentConnect_cdc03e84 to detect SILENTCONNECT activity.
Elastic Security Labs identified and documented SILENTCONNECT as a previously undocumented loader used in active campaigns. The observed chain used CAPTCHA-gated phishing sites, VBScript and PowerShell execution, in-memory C# compilation, defense evasion, and silent installation of ScreenConnect clients that persisted as services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Operation SilentCanvas** is using weaponized `.jpeg` files to compromise Windows systems and deploy a trojanized **ConnectWise ScreenConnect** remote access tool. In the campaign, a file such as `sysupdate.jpeg` is actually a PowerShell loader delivered through social engineering, including phishing, deceptive file-sharing, and fake software updates. The malware creates a staging directory at `C:\Systems`, downloads additional payloads from `legitserver.theworkpc[.]com` over TCP port `5443`, and compiles a custom launcher named `uds.exe` on the victim host using `csc.exe`. The intrusion chain includes runtime string reconstruction, in-memory execution of a secondary payload, **AMSI bypass**, and a **UAC bypass** that abuses the `ms-settings` registry path and launches `ComputerDefaults.exe` to gain elevated privileges without a visible prompt. Once installed, the malware enables persistent remote access, credential theft, encrypted command-and-control, screen capture, microphone monitoring, hidden desktop execution, and long-term persistence through a Windows service named **OneDriveServers** and hidden administrator accounts. Defenders were urged to monitor abused Windows binaries, investigate suspicious PowerShell and unexpected ScreenConnect activity, tightly control remote administration tools, isolate affected hosts, and reset privileged credentials after suspected compromise.
Jun 29, 2026
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026
Huntress identified a campaign in which attackers use social engineering—including fake technical support, phishing, fraudulent refund-search results, and Quick Assist abuse—to persuade victims to install trojanized ConnectWise ScreenConnect clients. Rather than exploiting a ScreenConnect vulnerability, the altered remote-support software detects incoming sessions and uses ScreenConnect file-transfer and remote-execution functions to send a staged four-part VBScript loader to the connecting endpoint, potentially infecting technician and help-desk systems without further user interaction. The payload chain profiles hosts, establishes persistence, seeks elevated execution, and can deploy remote-access, tunneling, and cryptocurrency-mining tools while attempting to evade security controls, including Microsoft Defender reporting and User Account Control. Huntress observed the activity at unrelated organizations during late-August incidents and advises organizations to reimage confirmed compromised systems, review ScreenConnect deployments and audit logs, and investigate suspicious Windows Script Host or PowerShell execution linked to ScreenConnect sessions.
Sep 8, 2026