Executive Summary
ThreatLabz researchers identified a sophisticated attack chain masquerading as an Adobe Acrobat Reader installer to deploy ScreenConnect. The infection begins with a heavily obfuscated VBScript loader that initiates a fileless sequence, utilizing PowerShell to compile and execute a .NET loader entirely in-memory. This approach effectively bypasses traditional disk-based detection mechanisms.
The attack is notable for its use of advanced evasion techniques, including image-name spoofing via PEB modification to impersonate legitimate Windows binaries and a UAC bypass leveraging auto-elevated COM objects. This allows the threat actor to gain administrative privileges without user notification before installing the ScreenConnect client from remote infrastructure. The combination of memory-only execution and process masquerading presents a significant challenge for standard security monitoring tools.