File extensions are not security boundaries. Operating systems that conflate display names with execution semantics continue to hand attackers the keys to the kingdom. A newly analyzed campaign labeled Operation SilentCanvas demonstrates this reality with surgical precision. It weaponizes an image disguise to bootstrap a multi-stage attack pipeline, turning trusted Windows binaries and a trojanized ScreenConnect instance into a stealthy, persistent backdoor.

The operators behind this campaign do not rely on zero-day vulnerabilities. Instead, they link together fileless execution, runtime compilation via native tooling, and a time-sensitive User Account Control (UAC) bypass. The result is total endpoint compromise without triggering typical administrative alerts.

Stage 0: The Counterfeit Container

The delivery mechanism relies on social engineering vectors: phishing emails, spoofed software update notifications, and deceptive file-sharing links. The initial payload lands on the file system as sysupdate.jpeg.

Hex-level inspection of sysupdate.jpeg reveals the first major anomaly. The file contains zero image data and entirely lacks the standard JPEG magic byte headers. Instead, raw PowerShell staging code sits within the file. Windows surfaces the icon and extension as an image, but the underlying execution routine processes it directly as a script.

Once triggered, this initial PowerShell routine builds a local staging directory at C:\Systems. To bypass static antivirus signatures, the script avoids hardcoded indicators by reconstructing payload strings dynamically at runtime. It then reaches out to external infrastructure at legitserver.theworkpc[.]com:5443 to retrieve the next components.

Deconstructing the Attack Pipeline

Operation SilentCanvas orchestrates its execution flow through distinct phases, systematically moving from initial script delivery to elevated persistence:

Attack Stage	Mechanism	Tactical Objective
Initial Access	Execution of sysupdate.jpeg	Delivery via phishing or fake update lures; initializes script execution.
Staging & Obfuscation	Dynamic string reconstruction in PowerShell	Creates C:\Systems, evades static signatures, and downloads assets from legitserver.theworkpc[.]com:5443.
In-Memory Execution	Secondary payload access.jpeg	Executes code directly in memory without dropping a secondary binary to disk.
Living-off-the-Land Compilation	Microsoft C# compiler (csc.exe)	Compiles custom launcher uds.exe on-host to establish a unique cryptographic hash.
UAC Bypass & Elevation	ms-settings protocol hijack via ComputerDefaults.exe	Executes uds.exe with auto-elevated privileges and deletes the registry key within 2 seconds.

Living Off the Land: Dynamic On-Host Compilation

Rather than dropping a pre-compiled binary that can be quickly flagged by hash-based Endpoint Detection and Response (EDR) systems, the attackers leverage Living-off-the-Land Binaries (LOLBins).

The staging script pulls down a secondary payload disguised as access.jpeg. This payload is processed and executed entirely in memory, operating as a fileless component that leaves no executable footprints on the disk.

From this in-memory foundation, the malware invokes Microsoft's legitimate on-system C# compiler, csc.exe. The compiler builds a custom native launcher, uds.exe, directly on the victim machine. Because compilation occurs on the target host, the resulting binary generates a unique hash and file signature. This tactic reliably blunts traditional signature-based detection systems that monitor file transfers across the network perimeter.

The Sub-Two-Second Elevation Window

With uds.exe compiled, the malware must escalate privileges without alerting the user via a standard UAC consent dialog.

The payload exploits the ms-settings registry protocol handler. Under normal conditions, launching ComputerDefaults.exe triggers Windows to auto-elevate the process because it is a trusted, internal Windows utility. When ComputerDefaults.exe executes, it queries the ms-settings registry path to locate its target executable.

Operation SilentCanvas hijacks this behavior:

1. The malware rewrites the ms-settings protocol mapping in the registry to point directly to uds.exe.
2. It invokes ComputerDefaults.exe.
3. ComputerDefaults.exe auto-elevates and immediately launches the modified ms-settings target (uds.exe) with full administrative rights, completely bypassing the UAC prompt.
4. Within two seconds of execution, the script purges the hijacked registry key.

This rapid cleanup drastically reduces the forensic window, wiping out the initial persistence indicators before standard registry polling can catch the alteration.

Full-Scope Backdoor Capabilities

The elevated execution context ultimately deploys a heavily modified, trojanized build of ScreenConnect. By repurposing a legitimate remote access framework, the threat actors secure comprehensive operational control through encrypted channels designed to blend into ordinary administrative traffic and resist deep packet inspection.

The operational capabilities granted by this deployment include:

• Surveillance Pipelines: Continuous real-time desktop monitoring, active video capture, and microphone recording.
• Input and Context Interception: Keystroke logging and clipboard hijacking.
• Covert Workspaces: Provisioning hidden desktop environments that operate entirely out of the active user's view, enabling covert concurrent execution.
• Pre-Auth Credential Capture: A dedicated component intercepts usernames and passwords at the Windows logon interface before they reach the authentication subsystem.
• Deep Persistence: Capability to quietly generate hidden local administrator accounts.

Engineering Mitigations

Hardening systems against the Operation SilentCanvas kill chain requires targeting its behavioral pinch points rather than relying solely on static file signatures.

• Audit and Constrain LOLBin Execution: Implement AppLocker or Windows Defender Application Control (WDAC) rules to block or heavily audit invocations of csc.exe, cvtres.exe, and auto-elevating utilities like ComputerDefaults.exe when initiated by untrusted parent processes.
• Detect In-Memory PowerShell Tradecraft: Deploy behavioral rules focused on in-memory assembly loading, runtime string reconstruction, and unusual network requests spawned directly from script interpreters.
• Harden Remote Access Deployments: Enforce strict allowlists on all remote administration utilities. Isolate endpoints immediately when unsanctioned instances of ScreenConnect are identified.
• Credential Hygiene: In any suspected compromise scenario, assume credentials entered at the local logon interface have been intercepted, and enforce an immediate credential reset for all privileged accounts across the domain.