SilentConnect Uses Fake Invites to Deploy ScreenConnect RAT

SILENTCONNECT Loader: Technical Overview

The SILENTCONNECT loader is a multi-stage Windows loader that exploits fake online invitations and trusted cloud services to deploy the ConnectWise ScreenConnect remote access tool on target systems. The operation employs social engineering, living-off-the-land binaries, and low-level evasion techniques to maintain access while avoiding detection.

The attack initiates with phishing emails masquerading as project invitations or proposal requests. These emails prompt users to click links that redirect to a Cloudflare Turnstile CAPTCHA page, serving as a human verification step. Upon completion, a VBScript file is automatically downloaded from Cloudflare's r2.dev object storage.

The VBScript, lightly obfuscated, uses a children's story as a decoy and conceals its logic with Replace() and Chr() calls. PowerShell compiles C# code in-memory as a .NET assembly and executes the HelloWorld::SayHello() entry point, avoiding traditional PE payloads on disk.

The SILENTCONNECT loader, a compact .NET component, silently delivers ScreenConnect. It uses PowerShell with ExecutionPolicy Bypass and curl.exe to fetch a C# source file, compiles it, and executes it in-memory. It employs NT APIs and COM APIs for memory writing and interaction while minimizing visibility.

The loader attempts a UAC bypass through the CMSTPLUA COM interface and performs PEB masquerading by modifying its own module entry. This disguises it as a benign Windows Help binary.

Once defenses are compromised, SILENTCONNECT uses curl.exe to download a ScreenConnect MSI from a specified domain and executes a silent installation via msiexec.exe. The ScreenConnect client registers as a Windows service, providing persistent remote access.

Attackers consistently use the download_invitee.php path across multiple domains, allowing researchers to identify additional infected sites. They leverage trusted platforms like Cloudflare and Google Drive for hosting, complicating network-level defense strategies.

Security teams are advised to monitor for VBScript file downloads, PowerShell commands combining Add-Type with remote downloads, and unexpected changes to Microsoft Defender exclusion lists. Regular audits should be conducted for unauthorized RMM installations and outbound connections to unknown ScreenConnect instances.

Based on reporting by GBHackers.