SILENTCONNECT Malware Uses Advanced Tactics to Deploy ScreenConnect

Key Takeaways

• A new multi-stage malware loader, SILENTCONNECT, has been observed deploying ConnectWise ScreenConnect on Windows systems since March 2025.
• The attack chain leverages sophisticated techniques including VBScript, in-memory PowerShell execution, and PEB masquerading to evade detection.
• The primary infection vector involves phishing emails directing victims to a CAPTCHA page that initiates a malicious VBScript download.
• Once deployed, ScreenConnect grants attackers full remote control, posing a significant threat to corporate networks.

Sophisticated SILENTCONNECT Malware Bypasses Defenses to Install Remote Access Tool

A recently uncovered multi-stage malware loader, dubbed SILENTCONNECT, has been actively compromising Windows environments since at least March 2025. This advanced threat utilizes a complex sequence of VBScript, in-memory PowerShell execution, and Process Environment Block (PEB) masquerading to secretly install the ConnectWise ScreenConnect remote monitoring and management (RMM) tool on targeted machines. The deployment of ScreenConnect provides attackers with complete “hands-on-keyboard” control, presenting a severe risk to organizations globally, as detailed in a report.

Initial Infection Vector and Evasion Tactics

The attack chain commences with a phishing email that lures recipients with seemingly legitimate invitations or proposals. Clicking the embedded link redirects the victim to a Cloudflare Turnstile CAPTCHA page, prompting them to verify they are human. Upon successfully completing the CAPTCHA, a VBScript file, often named “E-INVITE.vbs,” is automatically downloaded to the user’s system. Threat actors have been observed employing convincing filenames, such as “Proposal-03-2026.vbs,” to enhance the credibility of their lures and reduce victim suspicion before execution.

Elastic Security Labs researchers first detected this campaign in early March 2026. Their investigation was triggered by multiple behavioral alerts indicative of a “living-off-the-land” style infection. A key detection point was a “Suspicious Windows Script Downloaded from the Internet” rule, which allowed analysts to trace the infection back through file origin URLs. The VBScript was hosted on Cloudflare’s r2.dev storage, while the subsequent C# payload was retrieved from Google Drive. These platforms are typically trusted, making it challenging for conventional network defenses to block the malicious downloads.

Obfuscation and In-Memory Execution

SILENTCONNECT is designed to blend seamlessly with normal Windows operations to avoid detection. The VBScript file itself is heavily obfuscated, using a children’s story as a decoy while embedding its true malicious instructions within Replace and Chr functions. Once decoded, this VBScript executes a PowerShell command. This command leverages the native curl.exe utility to download a C# source file, which is then compiled at runtime using Add-Type and executed entirely within memory. This in-memory execution strategy prevents any malicious executable from being written to disk, thereby circumventing many endpoint security tools that rely on disk-based artifact detection.

Attacker Infrastructure and Operational Security Blunders

Analysis of the threat actor’s infrastructure has revealed a consistent operational pattern. A phishing email identified on VirusTotal, with the subject “YOU ARE INVITED,” was traced to the sender “dan@checkfirst[.]net[.]au,” which was impersonating a project proposal from a fictitious company. A critical operational security (OPSEC) mistake by the attackers involved reusing the same URI path, “download_invitee.php,” across multiple compromised websites. This error enabled researchers to map out the complete campaign infrastructure through targeted searches on VirusTotal.

PEB Masquerading and Advanced Defense Evasion

After the .NET loader is initiated, SILENTCONNECT rapidly employs advanced techniques to hide its presence from security solutions. Following a 15-second sleep period, the malware allocates executable memory using the NtAllocateVirtualMemory function and copies a small shellcode stub into this newly allocated region. This shellcode then retrieves the address of the Process Environment Block (PEB), a critical Windows structure that maintains a list of all modules loaded within a running process. This low-level operation allows the malware to function below the radar of commonly monitored API calls.

With access to the PEB address, SILENTCONNECT performs PEB masquerading. It locates its own module list entry and overwrites both the BaseDLLName and FullDllName fields to display “winhlp32.exe” and “c:windowswinhlp32.exe” respectively. Many Endpoint Detection and Response (EDR) solutions depend on PEB data as a trusted reference for identifying suspicious processes. By swapping its identity with a legitimate Windows help utility, the loader effectively disguises itself, making it nearly invisible to automated detection mechanisms.

Before installing ScreenConnect, the loader executes a User Account Control (UAC) bypass through the CMSTPLUA COM interface. It further obfuscates its parameters by storing them in reverse order. Critically, it then silently adds an exclusion for .exe files to Microsoft Defender. Subsequently, the ScreenConnect MSI package is downloaded from “bumptobabeco[.]top” via curl.exe, installed using msiexec.exe, and configured as a Windows service that beacons to the attacker’s server over TCP port 8041.

What You Should Do

• Audit RMM Deployments: Routinely audit your environment for any unauthorized deployments of remote monitoring and management (RMM) tools like ConnectWise ScreenConnect.
• Monitor Outbound Traffic: Implement strict monitoring of outbound network traffic, specifically looking for connections to unknown or suspicious ScreenConnect server addresses.
• Detect Suspicious PowerShell: Configure security tools to flag PowerShell commands that combine Add-Type with remote downloads, as this is a common tactic for in-memory execution.
• Alert on Internet-Fetched VBScripts: Set up alerts for VBScript files downloaded from the internet, particularly those with unusual or obfuscated content.
• Monitor Defender Exclusions: Watch for unexpected or unauthorized changes to Microsoft Defender exclusions, as attackers often disable security features to maintain persistence.
• Track Memory Allocations: Enhance monitoring for NtAllocateVirtualMemory calls originating from .NET processes, which can indicate the presence of this threat before full compromise.
• Educate Users: Conduct regular cybersecurity awareness training for employees, emphasizing the dangers of phishing emails and the importance of verifying links before clicking.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.