SMOKE#SCREEN Campaign Deploys ScreenConnect via Fake Adobe and Zoom Updates

Cybersecurity researchers at Securonix Threat Research have disclosed an active, multi-wave campaign codenamed SMOKE#SCREEN that leverages social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy ConnectWise ScreenConnect, a legitimate Remote Monitoring and Management (RMM) tool. According to researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee, the campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables, and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080. Successful attacks culminate with a ScreenConnect agent installed and beaconing to one of three attacker-controlled relay servers, providing persistent remote access to compromised systems. Security teams can investigate suspicious domains and IPs associated with this infrastructure using a WHOIS lookup to map attacker-controlled assets.

The initial access vector is assessed to be spear-phishing, with emails delivering an obfuscated Visual Basic Script dropper that performs a series of environment and anti-analysis checks before execution. The script aborts if any of the following tools are running: Wireshark, Process Monitor, Oracle VM VirtualBox, Broadcom VMware Tools, Citrix XenServer, or Fiddler Classic. If the environment checks pass, the script decrypts a PowerShell command that fetches a C# payload from 207.189.11[.]170. Analysis of the ScreenConnect relay configuration strings embedded in the MSI and EXE payloads has uncovered three distinct C2 clusters, each associated with software update, document review, and document viewer decoy binaries. Organizations can audit their exposed attack surface by running a port scanner to identify open ports that ScreenConnect relays typically use, such as port 8041.

A third sample linked to the activity is delivered as a compressed archive containing a batch script designed to disable Windows Antimalware Scan Interface (AMSI), escalate privileges via User Account Control (UAC), and turn off SmartScreen protections through registry modifications. Securonix's investigation began following the discovery of a live WsgiDAV server that served dual purposes: staging malicious payloads and maintaining command-and-control over existing infected machines through a ScreenConnect relay on port 8041. The activity has not been attributed to any known threat actor or group, but it reflects the growing abuse of legitimate RMM tools, which allow threat actors to bypass security controls and blend in with authorized IT tooling without deploying a purpose-built remote access trojan. Users concerned about phishing exposure can run a email breach checker to determine whether their credentials have appeared in known phishing-related data dumps.