Full Report
Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect. The campaign has been codenamed SMOKE#SCREEN by Securonix Threat
Analysis Summary
# Tool/Technique: SMOKE#SCREEN Campaign
## Overview
SMOKE#SCREEN is a multi-wave cyber campaign characterized by the use of social engineering lures (impersonating Adobe, Zoom, and business documents) to deploy legitimate Remote Monitoring and Management (RMM) software for persistent unauthorized access. The campaign is notable for its evolving tradecraft, ranging from obfuscated scripts to aggressive security software deactivation sequences.
## Technical Details
- **Type:** Malware Campaign / RMM Abuse
- **Platform:** Windows
- **Capabilities:** Anti-analysis, AMSI bypass, UAC escalation, EDR evasion, and Remote Desktop persistence.
- **First Seen:** Reported August 2026 (Securonix discovery).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- **[TA0002 - Execution]**
- [T1059.005 - Command and Scripting Interpreter: Visual Basic]
- [T1059.001 - PowerShell]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (AMSI, SmartScreen, Defender)
- [T1027 - Obfuscated Files or Information]
- [T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control]
- [T1096 - NTFS Alternate Data Streams] (Removing Zone.Identifier)
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software] (ConnectWise ScreenConnect)
- [T1572 - Protocol Tunneling] (Cloudflare Quick Tunnels)
## Functionality
### Core Capabilities
- **Legitimate RMM Deployment:** Stealthily installs ConnectWise ScreenConnect agents to establish a persistent "backdoor" using authorized software.
- **Environment Discovery:** Checks for analysis tools (Wireshark, Procmon) and virtualization (VMware, VirtualBox, Xen) before proceeding.
- **Security Disruption:** Executes a "nine-step Defender destruction sequence" to disable Windows Defender, AMSI, and SmartScreen.
### Advanced Features
- **Infrastructure Masking:** Utilizes Cloudflare Quick Tunnels (ephemeral URLs) and Dropbox shared links to bypass domain reputation filters.
- **WsgiDAV Staging:** Uses a live WsgiDAV-based server for payload delivery and C2 relay.
- **Anti-EDR Timing:** Employs specific execution delays and timing checks to evade detection by behavioral engines.
## Indicators of Compromise
- **File Names:**
- `zoom-update.html`
- `MemoryLoader.cs`
- `cloudflared.exe`
- **Network Indicators:**
- `207.174.0[.]143:8080` (WsgiDAV Staging)
- `207.189.11[.]170` (Payload delivery)
- `subscription-magnetic-recommended-meat.trycloudflare[.]com` (C2 Tunnel)
- Port `8041` (ScreenConnect Relay)
- **Behavioral Indicators:**
- Removal of `Zone.Identifier` ADS from MSI files.
- Unexpected Registry modifications to SmartScreen settings.
- Execution of VBScript followed by PowerShell and ScreenConnect installation.
## Associated Threat Actors
- **Unattributed:** Currently tracked by Securonix as SMOKE#SCREEN; no specific group (e.g., APT) has been named yet.
## Detection Methods
- **Behavioral Detection:** Monitor for scripts (VBS/PowerShell) attempting to modify Windows Defender or SmartScreen registry keys.
- **Process Monitoring:** Alert on `cloudflared.exe` or unauthorized ScreenConnect processes in environments where they are not standard IT tools.
- **EDR/SIEM:** Look for the removal of NTFS Alternate Data Streams (`Zone.Identifier`) immediately followed by an MSI installation.
## Mitigation Strategies
- **Execution Policy:** Restrict the execution of untrusted or unsigned MSI and VBScript files.
- **Software Restriction:** Implement application allow-listing to prevent unauthorized RMM tools (ScreenConnect, AnyDesk, etc.) from running.
- **Hardening:** Disable Windows Script Host (WSH) if not required for business operations to neutralize VBS droppers.
- **Network Filtering:** Block known tunneling services like Cloudflare Quick Tunnels if not explicitly needed.
## Related Tools/Techniques
- **ConnectWise ScreenConnect:** The primary RMM tool abused in this campaign.
- **Cloudflare Quick Tunnels:** Used for ephemeral C2 infrastructure.
- **WsgiDAV:** Used for the staging server infrastructure.