The Rise of SILENTCONNECT: New Stealthy Loader Exploits Trusted Cloud Giants

Elastic Security Labs discovered a live campaign using a new loader called SILENTCONNECT that delivers legitimate RMM tools (notably ConnectWise ScreenConnect) to victim machines via a Cloudflare Turnstile lure and Google Drive/Cloudflare hosting; the loader employs LOLBins, a VBScript-to-in-memory C# execution chain via PowerShell, UAC bypass, Windows Defender exclusions, and low-level API/PEB masquerading to maintain stealth and persistent hands-on-keyboard access, and the lab recommends auditing RMM usage and adopting behavioral monitoring.