Threat reportMalwareTL-2026-1880
SMOKE#SCREEN — Multi-Wave Phishing Campaign Abusing ConnectWise ScreenConnect RMM for Persistent Remote Access
SMOKE#SCREEN (TL-2026-1880) is a high-severity malware campaign, first published 2026-08-04 and last reviewed 2026-08-10. It has no confirmed attribution, affects Microsoft Windows, maps to 19 MITRE ATT&CK techniques (T1027, T1027.009, T1036), and is covered by 9 detection rules and 34 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 34Indicators of compromise
Key facts for TL-2026-1880
- Threat ID
- TL-2026-1880
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 34
- Updates
- 2026-08-10
Malware and tooling in SMOKE#SCREEN
Malware and tooling: CloudFlare Tunnel, ConnectWise - S0591, ConnectWise ScreenConnect, ScreenConnect, cloudflared.exe
How SMOKE#SCREEN works
An active, multi-wave social engineering campaign dubbed SMOKE#SCREEN delivers fake Zoom, Adobe Flash, and document-review lures that silently install legitimate DigiCert-signed ConnectWise ScreenConnect RMM agents for persistent remote access on Windows and macOS systems. The campaign chains obfuscated VBScript droppers, batch loaders, and compiled .NET executables against a live WsgiDAV staging server, Cloudflare Quick Tunnels, and Dropbox, with advanced evasion including AMSI bypass, Defender destruction, and an explicit 180-second delay to break Elastic correlation.
Securonix Threat Research (Shikha Sangwan, Akshay Gaikwad, Aaron Beardslee) tracks SMOKE#SCREEN as an active, multi-wave campaign in which adversaries use rotating social-engineering lures themed around Zoom software updates, business document reviews, system maintenance utilities, and Adobe Flash Player updates to deploy silent ScreenConnect Remote Monitoring and Management (RMM) agent installs. The campaign is not tied to a specific CVE or CVSS score; it is a malware delivery and RMM-abuse operation that exploits the trust enterprises place in legitimate, code-signed remote-access tooling. A live WsgiDAV (Python WebDAV) staging server at 207.174.0.143:8080 exposed an open directory of 15 payload files during investigation, and the same IP operated a ScreenConnect relay on port 8041 (dual-purpose delivery plus command and control). Beaconing was observed against three compartmentalized relay clusters, each with an independent RSA key pair: a primary cluster at 207.174.0.143:8041, a secondary cluster at 142.202.191.225:8041/80 (with a port 80 fallback to bypass restrictive firewalls), and a tertiary cluster at the domain blog.derrspecial-onlinedmin.live:8041, which is deliberately designed to blend in as an administrative portal. Early payload infra also included a former C# hosting node at 207.189.11.170 and the Cloudflare-proxied domain crestmarkhq.com.
Five distinct kill chains were reconstructed, each evolving in tradecraft. Kill Chain 1 uses an XOR-encrypted VBScript dropper (zoom-update.vbs) that runs environment checks (aborting if memory is below 2GB or if analysis tools such as wireshark, procmon, vboxservice, vmtoolsd, xenservice, or fiddler are present), walks a seven-state While/Select-Case state machine with junk arithmetic, decrypts a hex-encoded XOR payload (key gc1HXjFtHBbC659t), spawns hidden PowerShell, downloads working_payload.cs, and compiles C# in-memory via Add-Type. Kill Chain 2 uses a plain 23-line VBScript (RSKAdvGrpSupportingdocuments.vbs) impersonating an RSK Advisory Group business document, creating processes exclusively via the WMI Win32_Process class with ShowWindow=0 to avoid standard WScript.Shell detection. Kill Chain 3 is a batch/gzip loader (SystemCheck) that performs a reflection-based AMSI bypass, UAC auto-elevation, SmartScreen dismantlement via registry changes plus Explorer restart, and Defender exclusions for the entire %TEMP% directory and the MSI path, before silently installing the payload. Kill Chain 4 is a compiled .NET loader (MemoryLoader.cs, shipped as AdobeReader_Update.exe / NYbiLtvO.exe) that hides its console via P/Invoke and runs a nine-step Defender-destruction sequence through hidden PowerShell, then downloads the MSI via a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com) using a Mozilla/5.0 User-Agent. Kill Chain 5 is a successor .NET loader (loader.cs, a roughly 50MB self-contained encrypted bundle shipped as zFbJVuiX.exe / Zoomupdateinstaller.exe) that drops the aggressive Defender destruction in favor of an avoidance strategy, including an explicit 180-second delay commented as 'WAIT 3 MINUTES (Breaks Elastic correlation)'.
The final payload in every path is a legitimate ConnectWise ScreenConnect MSI signed with a valid DigiCert Authenticode certificate issued to Connectwise, LLC — a living-off-the-land technique that evades EDRs applying reduced scrutiny to recognized vendor code signing. The MSIs beacon to the attacker-controlled relays (e.g., with e=Access&y=Guest parameters) for persistent remote desktop access. Cross-platform targeting is deliberate: macOS .pkg variants (ZoomUpdateInstaller.pkg, Zoomupdateinstaller.pkg) connect to the same primary relay as the Windows MSI payloads. The campaign also demonstrates active hash rotation (the original 15 staging files were rotated to 9 new files during investigation), making signature-based detection ineffective. No named threat group has been attributed; the actor is described as well-resourced with deliberate operational security and compartmentalized infrastructure. The tradecraft evolution — from cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction to a current stealth pivot with anti-EDR timing and self-contained encrypted bundles — evidences a real-time attacker/defender arms race.
MITRE ATT&CK techniques used in TL-2026-1880
Defense Evasion
T1027 Obfuscated Files or Information; T1027.009 Embedded Payloads; T1036 Masquerading; T1070.004 File Deletion; T1497.001 System Checks; T1564.003 Hidden Window
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
stealth
Persistence
privilege-escalation
T1548.002 Bypass User Account Control
defense-impairment
T1553.005 Mark-of-the-Web Bypass; T1685 Disable or Modify Tools
Initial Access
Affected products and versions in SMOKE#SCREEN
- Microsoft — Windows
Vulnerable versions: Workstations (default ScreenConnect install); Servers (default ScreenConnect install) - Apple — macOS
Vulnerable versions: Deliberately targeted via .pkg variants - ConnectWise — ScreenConnect
Vulnerable versions: Legitimate signed RMM agent abused as final payload
Remediation for SMOKE#SCREEN
Patches
- Not applicable: this campaign abuses legitimate RMM software and social engineering rather than a software vulnerability; no CVE/patch exists
Immediate actions
- Block the known IOC IPs (207.174.0.143, 142.202.191.225, 207.189.11.170), the domain blog.derrspecial-onlinedmin.live, and the Cloudflare Quick Tunnel at the perimeter
- Restrict MSI execution: AppLocker/WDAC policies that block MSIs from %TEMP%, Downloads, and AppData
- Monitor and alert on security-product tampering: WinDefend service stop, registry modifications, and C:\ exclusion-path adds
- Audit and block unauthorized ScreenConnect/AnyDesk/Atera remote-access connections to raw IP addresses
Workarounds
- Block execution of MSIs/EXEs carrying a removed Mark-of-the-Web (Zone.Identifier) ADS
- Block outbound access to Cloudflare Quick Tunnel (trycloudflare.com) hosts and Dropbox share delivery for remote-access installers
Longer-term hardening
- Deploy behavioral EDR rules detecting anomalous parent-child chains (e.g., powershell -> msiexec with /qn) and RMM agent installation from non-standard parents
- Enforce strict UAC ('Always notify') to prevent standard-user UAC bypass
- Inventory approved RMM tooling and maintain a baseline of legitimate remote-access software
- Apply code-signing and reputation policies that scrutinize RMM binaries even when vendor-signed
Timeline of SMOKE#SCREEN
- Details publicly disclosed by Securonix Threat Research; covered by The Hacker News, Dark Reading, and InfoSec Today.
- During the investigation, the original 15 staging-server payload files were rotated to 9 new files, evidencing active hash rotation that defeats signature-based detection.
- Current-observed tradecraft: pivot to stealth with ~50MB self-contained encrypted bundles and an explicit 180-second delay commented as breaking Elastic correlation.
- Middle-observed tradecraft: batch-file and compiled .NET loaders executing aggressive nine-step Defender-destruction sequences, AMSI bypass, UAC bypass, and SmartScreen dismantlement.
- Earliest observed tradecraft: XOR-encrypted VBScript droppers with a seven-state state machine, sandbox/VM evasion checks, and WMI-only process creation.
- Securonix Threat Research (Sangwan, Gaikwad, Beardslee) identifies and documents the active, multi-wave SMOKE#SCREEN campaign of silent ScreenConnect RMM agent installs.
Update history for TL-2026-1880
- 2026-08-10 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 53 community-related indicator(s).
Sources cited for SMOKE#SCREEN
- SMOKE#SCREEN: ScreenConnect RMM Abuse via Cloudflare Tunnels
- Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
- Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook
- Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access (InfoSec Today)
- How a single ScreenConnect incident exposed a massive campaign (Kaspersky/Securelist)
Detection coverage for TL-2026-1880
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1880 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1880
11 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.