SMOKE#SCREEN Campaign Deploys ScreenConnect via Fake Software Updates
A sophisticated campaign dubbed SMOKE#SCREEN is using social engineering tactics with fake Adobe and Zoom updates to install ConnectWise ScreenConnect, granting attackers persistent remote access.
A multi-wave cyber campaign, codenamed SMOKE#SCREEN by Securonix Threat Research, is actively exploiting social engineering lures to deploy Remote Monitoring and Management (RMM) tools, most notably ConnectWise ScreenConnect. Threat actors are leveraging themes such as fake software updates for popular applications like Adobe and Zoom, alongside deceptive prompts for business document reviews and system maintenance utilities, to trick unsuspecting users into installing malicious payloads.
The campaign's technical infrastructure is notable, relying on a toolkit that includes VBScript droppers, batch file loaders, compiled .NET executables, and an HTML phishing page. These components ultimately connect to a live WsgiDAV-based staging server, facilitating the delivery of the final payload. Successful compromises result in the installation of a ScreenConnect agent, which then beacons to attacker-controlled relay servers, providing persistent remote access to the victim's system. At present, the activity has not been definitively attributed to any specific known threat actor or group.
The abuse of legitimate RMM tools like ScreenConnect is a growing trend in the threat landscape. These tools are often pre-installed or authorized within enterprise environments, allowing attackers to bypass traditional security controls and blend in with legitimate IT operations. This strategy negates the need for deploying custom-built remote access trojans, making detection more challenging.
Securonix researchers observed the campaign's staging server serving two primary functions: distributing malicious payloads and maintaining command-and-control (C2) over already infected machines via a ScreenConnect relay. Analysis of ScreenConnect relay configuration strings embedded within the MSI and EXE payloads revealed three distinct C2 clusters, each associated with specific decoy binaries related to software updates, document reviews, or document viewers.
The initial vector for this campaign is believed to be spear-phishing. Emails contain obfuscated Visual Basic Script (VBScript) droppers that first perform environmental checks to evade analysis and ensure safe execution. These scripts enumerate running processes and will abort if common security and analysis tools like Wireshark, Process Monitor, or virtual machine components are detected. If these checks pass, the script proceeds to decrypt and execute a PowerShell command to fetch a C# payload from a remote server.
Attackers have also employed business-themed lures to prompt users into running VBScripts that ultimately lead to ScreenConnect installation. Another observed delivery method involves compressed archives containing batch scripts. These scripts are designed to disable Windows Antimalware Scan Interface (AMSI), escalate privileges via User Account Control (UAC) prompts, disable SmartScreen protections through registry modifications, and remove the Zone.Identifier alternate data stream (ADS) from downloaded MSI files before execution.
The campaign's delivery strategy has evolved, utilizing various trusted hosting services to evade detection. Early phishing pages hosted payloads via Dropbox shared links, leveraging the platform's allow-listed status in many corporate environments. More recently, attackers have used Cloudflare Quick Tunnels, a service for temporary local server exposure, with the staging server itself running cloudflared.exe to generate these ephemeral tunnels.
Regardless of the specific phishing lure or delivery method, all attack paths converge on the installation of the ScreenConnect client. This allows the operator to establish a remote desktop session with the victim's machine, enabling a wide range of post-exploitation activities. Securonix highlights the campaign's observable evolution in tradecraft, from cautious encrypted scripts to aggressive anti-Defender sequences and back to stealthy EDR evasion techniques, illustrating a dynamic arms race between attackers and defenders.