Operation SilentCanvas: JPEG File Deploys Trojanized ScreenConnect Malware

• •Attack leverages a weaponized JPEG file to deliver malware.
• •Malware enables remote access and credential theft on Windows systems.
• •Campaign utilizes advanced evasion techniques to bypass detection.

A sophisticated multi-stage intrusion campaign has been identified, utilizing a weaponized JPEG file named sysupdate.jpeg to deliver a trojanized version of ConnectWise ScreenConnect. The attack likely begins with social engineering tactics such as phishing emails and malicious attachments. Upon execution, the malware creates a staging environment, downloads additional payloads, and uses advanced techniques to evade detection. It employs a custom launcher compiled through Microsoft's .NET compiler and abuses Windows components for privilege escalation. The malware enables remote access, credential theft, and long-term persistence within compromised systems. Affected systems include Windows environments where the malware can blend malicious activity with legitimate software operations. The campaign highlights the risks associated with seemingly innocuous file types and the need for enhanced security measures against such threats.