CYFIRMA uncovered a multi-stage intrusion using a PowerShell payload hidden as sysupdate.jpeg to deploy a trojanized ConnectWise ScreenConnect for stealthy remote access, exploiting AMSI and UAC bypasses. #PowerShellAttack #FilelessIntrusion
OPERATION SILENTCANVAS : JPEG BASED MULTISTAGE POWERSHELL INTRUSION
CYFIRMA identified a multi-stage intrusion that used a weaponized PowerShell payload disguised as sysupdate.jpeg to deploy a trojanized ConnectWise ScreenConnect instance for covert remote access. The campaign relied on AMSI bypass, on-host .NET compilation, a fileless UAC bypass, and encrypted command-and-control through legitserver.theworkpc[.]com and 45.138.16[.]64. #ConnectWiseScreenConnect #ComputerDefaults.exe #legitserver.theworkpc.com #sysupdate.jpeg #OneDriveServers
www.hendryadrian.com
May 9, 2026 at 11:45 AM
CYFIRMA uncovered a multi-stage intrusion using a PowerShell payload hidden as sysupdate.jpeg to deploy a trojanized ConnectWise ScreenConnect for stealthy remote access, exploiting AMSI and UAC bypasses. #PowerShellAttack #FilelessIntrusion