Operation SilentCanvas is a multi-stage intrusion campaign leveraging a weaponized PowerShell payload hidden as a JPEG image (sysupdate.jpeg). Initial infection vectors likely include phishing or malicious attachments. The malware establishes a staging environment, retrieves further payloads from attacker-controlled infrastructure, and uses the legitimate .NET compiler (csc.exe) to dynamically compile a custom launcher, aiding evasion. It abuses ComputerDefaults.exe and a malicious ms-settings registry hijack to perform a fileless UAC bypass, gaining elevated privileges without triggering typical defenses. Post-elevation, it deploys a persistent service disguised as OneDriveServers and launches a trojanized ConnectWise ScreenConnect instance modified for credential interception, remote command execution, surveillance, and SYSTEM-level code execution. The campaign uses fileless execution and AMSI bypass techniques to avoid detection. Indicators include multiple file hashes and a domain (legitserver.theworkpc.com). There is no CVE or vendor patch information, and no known exploits in the wild have been reported.

The campaign enables attackers to gain covert remote access with SYSTEM-level privileges, allowing credential theft, remote command execution, and surveillance operations. The use of fileless execution and legitimate Windows binaries for privilege escalation and evasion increases the difficulty of detection and mitigation. The trojanized ConnectWise ScreenConnect instance provides a persistent backdoor for attackers. Although no known exploits in the wild are reported, the campaign poses a medium severity threat due to its sophisticated techniques and potential for extensive system compromise.

No official patch or remediation guidance is currently available for this campaign. Organizations should rely on threat intelligence to detect indicators of compromise such as the provided file hashes and domain names. Since the attack uses social engineering vectors, user awareness training to recognize phishing attempts is recommended. Monitoring for abuse of legitimate Windows binaries (e.g., ComputerDefaults.exe, csc.exe) and registry hijacks related to ms-settings may help identify suspicious activity. Because the campaign employs fileless techniques and AMSI bypass, endpoint detection and response solutions with behavioral analysis capabilities may improve detection. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.