MalwarePublished 19 Mar 2026Updated 18 Apr 2026

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

Source AlienVault OTX General

Description

A newly discovered loader called SILENTCONNECT is being used in active campaigns to silently install ScreenConnect, a remote monitoring and management tool, on victim machines. The infection chain begins with users being redirected to a Cloudflare Turnstile CAPTCHA page disguised as a digital invitation. Upon clicking, a VBScript file is downloaded, which retrieves and executes C# source code in memory using PowerShell. SILENTCONNECT employs various evasion techniques, including PEB masquerading and UAC bypass. The campaigns leverage trusted hosting providers like Google Drive and Cloudflare, and abuse living-off-the-land binaries. The loader has been active since March 2025 and poses a significant threat due to its stealthy nature and effectiveness.

Impact

The deployment of SILENTCONNECT poses a substantial risk to organizations globally by enabling attackers to gain persistent, stealthy remote access via ScreenConnect. This access can lead to unauthorized data exfiltration, intellectual property theft, espionage, and disruption of business operations. The use of legitimate RMM software complicates detection and attribution, as malicious activity may blend with normal administrative tasks. The UAC bypass and in-memory execution techniques increase the likelihood of successful compromise even in environments with endpoint protection solutions. Organizations with remote workforce setups or those using ScreenConnect legitimately may face increased risk of credential theft or lateral movement within their networks. The abuse of trusted cloud services for payload hosting can bypass perimeter defenses, increasing infection rates. Overall, the threat can degrade confidentiality, integrity, and availability of critical systems, potentially causing financial loss, reputational damage, and regulatory consequences.

Defensive guidance

1. Implement strict email and web filtering to block phishing attempts, especially those mimicking invitations or using CAPTCHA pages. 2. Monitor and restrict execution of VBScript and PowerShell scripts, particularly those that download and execute code in memory. Use PowerShell logging and enable script block logging to detect suspicious activity. 3. Employ application control or whitelisting to prevent unauthorized execution of living-off-the-land binaries and unknown scripts. 4. Enforce the principle of least privilege and configure UAC policies to limit privilege escalation opportunities. 5. Monitor network traffic for unusual connections to known malicious domains and IP addresses associated with SILENTCONNECT campaigns. 6. Regularly audit and monitor the use of legitimate RMM tools like ScreenConnect to detect unauthorized installations or anomalous usage patterns. 7. Use endpoint detection and response (EDR) solutions capable of detecting in-memory code execution and PEB masquerading techniques. 8. Educate users to recognize phishing lures and suspicious invitations, emphasizing caution before interacting with unexpected CAPTCHA challenges or download prompts. 9. Maintain up-to-date threat intelligence feeds and indicators of compromise (IOCs) to enhance detection capabilities. 10. Segment networks to limit lateral movement if a system is compromised.

Indicators of compromise

Domains 4

bumptobabeco.top
imansport.ir
solpru.com
checkfirst.net.au

URLs 3

http://imansport.ir/download_invitee.php
http://solpru.com/process/docusign.html
https://bumptobabeco.top/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest'

IP addresses 1

86.38.225.59

Hashes 7

281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3
349e78de0fe66d1616890e835ede0d18580abe8830c549973d7df8a2a7ffdcec
81956d08c8efd2f0e29fd3962bcf9559c73b1591081f14a6297e226958c30d03
8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db
adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37
c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7
1b576ebba5b7bbd023eea1b15dac1ed3fb76a211

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Mar 2026, 13:53 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details