According to Security Affairs, a sophisticated cyber operation identified as SMOKE#SCREEN is currently utilizing deceptive software lures to deploy the ConnectWise ScreenConnect remote monitoring and management (RMM) tool on target machines. By mimicking legitimate updates from software providers like Zoom and Adobe, attackers establish persistent, unauthorized access that closely resembles routine IT administrative activity.
Securonix Threat Research, which has been monitoring the campaign, reports that the attackers utilize a variety of delivery mechanisms including VBScript droppers, batch files, and .NET executables. A central staging server located at 207.174.0.143:8080 was discovered, containing 15 payload files in an openly browsable directory. This same infrastructure hosts a ScreenConnect relay on port 8041.
Infrastructure and Payload Data
| Attribute | Specification |
|---|---|
| Staging Server IP | 207.174.0.143 |
| Staging Port | 8080 |
| Relay Server Port | 8041 |
| Payload Files Discovered | 15 |
| Minimum RAM Check | 2 GB |
The campaign has demonstrated a marked evolution in tactics. Early iterations employed complex techniques like XOR encryption and environment checks to evade analysis, specifically aborting if the host machine contained less than 2 GB of RAM or detection tools like Wireshark and Process Monitor. Newer samples have adopted more aggressive methods, including disabling the Windows Defender (WinDefend) service, modifying registry keys to bypass SmartScreen, and applying memory patching to disable the Antimalware Scan Interface (AMSI).
Why It Matters
The SMOKE#SCREEN campaign highlights the danger of "living-off-the-land" techniques, where attackers abuse legitimate remote administration software to mask malicious presence. By integrating trusted tools into the attack chain, threat actors successfully lower the visibility of their persistent access. For enterprise environments, this underscores that relying on traditional signature-based detection is insufficient. Security teams must shift toward behavioral monitoring that can distinguish between authorized IT management traffic and unauthorized persistent beaconing, even when that traffic originates from enterprise-grade software such as ScreenConnect.
Reader Discussion & Insights