SILENTCONNECT Uses VBScript, PowerShell and PEB Masquerading to Deploy ScreenConnect

SILENTCONNECT is a sophisticated multi-stage malware loader observed since at least March that delivers a C# .NET loader via an obfuscated VBScript phishing lure; it compiles and executes payloads in-memory, uses PEB masquerading to spoof process names, performs a UAC bypass and adds Defender exclusions, then installs ConnectWise ScreenConnect to provide attackers full remote control. Researchers traced the campaign through reused URI paths and hosting on trusted services (Cloudflare R2, Google Drive), and recommend monitoring for VBScript downloads, PowerShell Add-Type remote-download patterns, NtAllocateVirtualMemory calls from .NET processes, unexpected Defender exclusions, and unauthorized RMM deployments.