# SMOKE#SCREEN — Multi-Wave Phishing Campaign Abusing ConnectWise ScreenConnect RMM for Persistent Remote Access

> An active, multi-wave social engineering campaign dubbed SMOKE#SCREEN delivers fake Zoom, Adobe Flash, and document-review lures that silently install legitimate DigiCert-signed ConnectWise ScreenConnect RMM agents for persistent remote access on Windows and macOS systems. The campaign chains obfuscated VBScript droppers, batch loaders, and compiled .NET executables against a live WsgiDAV staging server, Cloudflare Quick Tunnels, and Dropbox, with advanced evasion including AMSI bypass, Defender destruction, and an explicit 180-second delay to break Elastic correlation.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-10T21:07:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1880
- **ID:** TL-2026-1880
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Securonix Threat Research (Shikha Sangwan, Akshay Gaikwad, Aaron Beardslee) tracks SMOKE#SCREEN as an active, multi-wave campaign in which adversaries use rotating social-engineering lures themed around Zoom software updates, business document reviews, system maintenance utilities, and Adobe Flash Player updates to deploy silent ScreenConnect Remote Monitoring and Management (RMM) agent installs. The campaign is not tied to a specific CVE or CVSS score; it is a malware delivery and RMM-abuse operation that exploits the trust enterprises place in legitimate, code-signed remote-access tooling. A live WsgiDAV (Python WebDAV) staging server at 207.174.0.143:8080 exposed an open directory of 15 payload files during investigation, and the same IP operated a ScreenConnect relay on port 8041 (dual-purpose delivery plus command and control). Beaconing was observed against three compartmentalized relay clusters, each with an independent RSA key pair: a primary cluster at 207.174.0.143:8041, a secondary cluster at 142.202.191.225:8041/80 (with a port 80 fallback to bypass restrictive firewalls), and a tertiary cluster at the domain blog.derrspecial-onlinedmin.live:8041, which is deliberately designed to blend in as an administrative portal. Early payload infra also included a former C# hosting node at 207.189.11.170 and the Cloudflare-proxied domain crestmarkhq.com.

Five distinct kill chains were reconstructed, each evolving in tradecraft. Kill Chain 1 uses an XOR-encrypted VBScript dropper (zoom-update.vbs) that runs environment checks (aborting if memory is below 2GB or if analysis tools such as wireshark, procmon, vboxservice, vmtoolsd, xenservice, or fiddler are present), walks a seven-state While/Select-Case state machine with junk arithmetic, decrypts a hex-encoded XOR payload (key gc1HXjFtHBbC659t), spawns hidden PowerShell, downloads working_payload.cs, and compiles C# in-memory via Add-Type. Kill Chain 2 uses a plain 23-line VBScript (RSKAdvGrpSupportingdocuments.vbs) impersonating an RSK Advisory Group business document, creating processes exclusively via the WMI Win32_Process class with ShowWindow=0 to avoid standard WScript.Shell detection. Kill Chain 3 is a batch/gzip loader (SystemCheck) that performs a reflection-based AMSI bypass, UAC auto-elevation, SmartScreen dismantlement via registry changes plus Explorer restart, and Defender exclusions for the entire %TEMP% directory and the MSI path, before silently installing the payload. Kill Chain 4 is a compiled .NET loader (MemoryLoader.cs, shipped as AdobeReader_Update.exe / NYbiLtvO.exe) that hides its console via P/Invoke and runs a nine-step Defender-destruction sequence through hidden PowerShell, then downloads the MSI via a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com) using a Mozilla/5.0 User-Agent. Kill Chain 5 is a successor .NET loader (loader.cs, a roughly 50MB self-contained encrypted bundle shipped as zFbJVuiX.exe / Zoomupdateinstaller.exe) that drops the aggressive Defender destruction in favor of an avoidance strategy, including an explicit 180-second delay commented as 'WAIT 3 MINUTES (Breaks Elastic correlation)'.

The final payload in every path is a legitimate ConnectWise ScreenConnect MSI signed with a valid DigiCert Authenticode certificate issued to Connectwise, LLC — a living-off-the-land technique that evades EDRs applying reduced scrutiny to recognized vendor code signing. The MSIs beacon to the attacker-controlled relays (e.g., with e=Access&y=Guest parameters) for persistent remote desktop access. Cross-platform targeting is deliberate: macOS .pkg variants (ZoomUpdateInstaller.pkg, Zoomupdateinstaller.pkg) connect to the same primary relay as the Windows MSI payloads. The campaign also demonstrates active hash rotation (the original 15 staging files were rotated to 9 new files during investigation), making signature-based detection ineffective. No named threat group has been attributed; the actor is described as well-resourced with deliberate operational security and compartmentalized infrastructure. The tradecraft evolution — from cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction to a current stealth pivot with anti-EDR timing and self-contained encrypted bundles — evidences a real-time attacker/defender arms race.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1218.007 Msiexec
- T1543.003 Windows Service
- T1027 Obfuscated Files or Information
- T1027.009 Embedded Payloads
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1564.003 Hidden Window
- T1553.005 Mark-of-the-Web Bypass
- T1548.002 Bypass User Account Control
- T1070.004 File Deletion
- T1036 Masquerading
- T1071.001 Web Protocols
- T1219 Remote Access Tools

## Sources

- [SMOKE#SCREEN: ScreenConnect RMM Abuse via Cloudflare Tunnels](https://www.securonix.com/blog/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels/)
- [Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access](https://thehackernews.com/2026/08/fake-adobe-and-zoom-updates-install.html)
- [Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook](https://www.darkreading.com/cyberattacks-data-breaches/latest-rmm-fueled-phishing-attack-exposes-threat-actor-playbook)
- [Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access (InfoSec Today)](https://www.infosectoday.io/fake-adobe-and-zoom-updates-install-screenconnect-for-persistent-remote-access/)
- [How a single ScreenConnect incident exposed a massive campaign (Kaspersky/Securelist)](https://securelist.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1880