SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access
ID: 48abbdad-3146-5b88-a7cd-60f77748bbab
STIX ID: report--48abbdad-3146-5b88-a7cd-60f77748bbab
Feed Name: Security Affairs
SMOKE#SCREEN is an active multi-wave campaign that lures victims with fake Zoom updates and other trusted prompts to install legitimate ConnectWise ScreenConnect RMM (signed by DigiCert), giving attackers persistent remote access; researchers observed live staging/relay infrastructure (207.174.0.143), multiple delivery mechanisms (VBScript, batch, .NET loaders, HTML phishing), payload evolution from AV-killing behavior to stealthy anti-EDR timing, and recommended behavioral detection strategies focused on Defender tampering, unexpected MSI installs, and ScreenConnect connections to raw IPs.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.