Malware - SILENTCONNECT Delivers ScreenConnect Tool

What Happened

Elastic Security Labs has uncovered a new malware loader named SILENTCONNECT. This multi-stage loader is designed to silently deploy the ScreenConnect remote monitoring and management (RMM) tool. The infection begins with users being misled to a Cloudflare Turnstile CAPTCHA page, disguised as a digital invitation. When users click the link, a VBScript file is downloaded to their machine, which initiates a chain of events leading to the installation of malicious software.

The process starts with the execution of a VBScript that retrieves C# source code. This code is compiled and executed in memory using PowerShell. The final payload, ScreenConnect, allows attackers to gain hands-on access to victim machines, raising significant security concerns for organizations.

Who's Being Targeted

The SILENTCONNECT campaign primarily targets users through phishing emails. These emails often impersonate legitimate proposals, enticing recipients to click on malicious links. For instance, one email sample, titled "YOU ARE INVITED.eml", was found to be sent from a fake account, inviting users to submit proposals. This approach effectively lures victims into downloading the malware.

Additionally, the attackers exploit trusted hosting services like Google Drive and Cloudflare to distribute their malicious payloads. By using these platforms, they evade detection and make it challenging for security measures to block the malicious content.

Signs of Infection

Victims of SILENTCONNECT may notice unusual behavior on their systems, such as unexpected installations or the presence of the ScreenConnect software. The malware employs various evasion techniques, including User Account Control (UAC) bypass and Process Environment Block (PEB) masquerading, to remain undetected. Security alerts may trigger when the initial VBScript is executed, but many users may overlook these warnings.

Organizations should be vigilant for signs of unauthorized RMM usage, as the presence of tools like ScreenConnect can indicate a compromised system. Regular audits and monitoring are essential to detect such infections early.

How to Protect Yourself

To safeguard against SILENTCONNECT and similar malware, users should adopt several best practices:

• Be cautious with email invitations: Verify the sender's identity and avoid clicking on suspicious links.
• Implement security software: Use comprehensive security solutions that can detect and block malware before it executes.
• Educate employees: Regular training on recognizing phishing attempts can greatly reduce the risk of infection.
• Monitor network traffic: Keep an eye on connections to known malicious domains or unusual traffic patterns.

By staying informed and proactive, individuals and organizations can better protect themselves against the evolving threat landscape posed by malware like SILENTCONNECT.