Elastic Security Labs has identified a new malicious campaign that uses an undocumented loader, dubbed SILENTCONNECT, to deliver the ScreenConnect Remote Monitoring and Management (RMM) tool.
This stealthy operation has remained largely undetected since March 2025 by abusing trusted platforms and living-off-the-land binaries to execute its payload.
Infection Chain and Evasion Techniques
The SILENTCONNECT infection chain initiates when a user receives a phishing email masquerading as a project proposal or digital invitation.
The provided link redirects the victim to a fake Cloudflare Turnstile CAPTCHA page hosted on compromised infrastructure. Once the user clicks the verification checkbox, a minimally obfuscated VBScript file is downloaded to the target machine.
This script serves as the initial downloader, leveraging a decoy children’s story and string manipulation to mask its true intent.
Upon execution, the VBScript spawns a PowerShell process that uses the curl utility to fetch an obfuscated C# payload from Google Drive.
This payload is saved temporarily before PowerShell compiles the C# source code at runtime using the Add-Type cmdlet. The compiled .NET assembly is then loaded directly into memory and executed reflectively, entirely avoiding traditional disk-based execution footprints.
Once the core SILENTCONNECT loader is active, it employs sophisticated evasion tactics to hide from security solutions. The malware allocates executable memory using the native NtAllocateVirtualMemory API.
It injects a small shellcode stub to locate the Process Environment Block (PEB) dynamically. By accessing the PEB directly, SILENTCONNECT bypasses higher-level Windows APIs that are monitored.
The loader then modifies its own module entries within the PEB, overwriting its name and path to masquerade as the benign Windows utility winhlp32.exe.
This PEB masquerading technique effectively blinds endpoint detection and response (EDR) agents that rely on the PEB as a trusted data source.
Operational Infrastructure and Identifiers
The threat actors behind SILENTCONNECT heavily abuse legitimate hosting providers, specifically Cloudflare and Google Drive, making it difficult for network defenders to block the malicious traffic outright.
However, the attackers exhibited poor operational security by consistently reusing the URI path download_invitee.php across various compromised websites.
This consistent naming convention allowed researchers to pivot and uncover additional infrastructure, including fake DocuSign and Microsoft Teams portals that distributed RMM agents directly.
The abuse of legitimate RMM software like ScreenConnect Elastic remains a growing trend, as these tools are inherently trusted within corporate environments and blend seamlessly with typical administrative traffic.
Security teams are advised to monitor for unexpected Defender exclusions, track unexpected memory allocation calls from .NET processes, and audit their networks for unauthorized RMM usage.
The following table outlines the key indicators and file artifacts associated with this campaign.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
