A sophisticated cyber campaign, dubbed SMOKE#SCREEN, has been identified, leveraging legitimate remote monitoring and management (RMM) tools to gain unauthorized access to both Windows and macOS systems. This operation employs deceptive tactics, disguising malicious payloads as routine software updates and business-related files, thereby tricking users into inadvertently installing remote access agents.
The campaign’s modus operandi involves delivering files that, when executed, install a legitimate RMM agent. This installation grants attackers remote control over the victim’s computer, enabling them to perform actions that mimic standard IT support activities. The versatility of this approach allows the campaign to target a broad range of devices within organizational environments.
Deceptive Delivery Mechanisms
SMOKE#SCREEN utilizes various lures to entice users into executing the malicious files. These include counterfeit prompts for Zoom updates, document reviews, system checks, and Adobe-related downloads. Such familiar and seemingly innocuous prompts increase the likelihood of user interaction, facilitating the covert installation of the RMM agent.
Security researchers at Securonix have been monitoring this campaign, noting its strategic use of legitimate tools to achieve malicious objectives. By installing ScreenConnect, a widely used RMM software, the attackers can establish remote access that closely resembles legitimate IT support activities, thereby evading detection.
Technical Exploitation and Evasion Tactics
The campaign exploits ScreenConnect, a legitimate RMM program, to gain control over targeted systems. While ScreenConnect itself is not inherently malicious, its unauthorized installation provides attackers with extensive capabilities, including desktop control, file access, and the potential to deploy additional malicious payloads without triggering conventional security alerts.
Investigations have revealed that the attackers employ a combination of scripts, batch files, compiled loaders, and deceptive web pages to deliver the RMM agent. Notably, the campaign utilizes Cloudflare Quick Tunnels to obscure the true origin of the downloads, complicating efforts to trace and block the malicious activity.
A distinctive aspect of SMOKE#SCREEN is its cross-platform design. The campaign includes a macOS installer configured to communicate with the same command-and-control infrastructure as its Windows counterpart. This indicates a deliberate effort to target users across diverse operating systems, reflecting the attackers’ adaptability and broad targeting strategy.
To evade detection, the campaign frequently updates its payloads, rendering simple hash-based blocking ineffective. Researchers have observed multiple relay clusters and servers that both stage payloads and manage remote connections. This infrastructure design allows the attackers to maintain access even if parts of their operation are uncovered.
Social Engineering and User Deception
The success of SMOKE#SCREEN heavily relies on sophisticated social engineering tactics. For instance, one deceptive web page mimicked a Zoom update notification, automatically initiating a download after a brief delay. Another impersonated an Adobe Flash Player update prompt. These tactics exploit users’ familiarity with such prompts, leading them to execute the malicious files without suspicion.
This approach aligns with a broader trend where attackers misuse trusted RMM tools as final payloads. For defenders, the challenge lies not only in identifying malicious files but also in discerning whether newly installed remote-access tools are authorized and connected to legitimate services.
Evolution of Evasion Techniques
SMOKE#SCREEN has evolved its evasion strategies over time. Initially, the campaign employed heavily obfuscated scripts and aggressive loaders designed to disable Windows security features before delivering the payload. These scripts targeted security scanning processes, user account controls, and endpoint settings, while also removing evidence of the installation to minimize detection.
Subsequent iterations of the campaign adopted a more subtle approach. The attackers reduced overt security-disabling actions, instead introducing deliberate delays between installation and activation of the RMM service. This tactic appears intended to disrupt security event correlation, making detection more challenging.
This evolution underscores the importance of monitoring sequences of related actions rather than isolated suspicious files. Organizations are advised to restrict the execution of untrusted MSI installers from user-writable directories, enforce strict User Account Control settings, and implement alerts for attempts to disable security services or create broad antivirus exclusions. Additionally, monitoring for unusual script-to-installer executions, particularly those involving PowerShell or command shell processes initiating silent installations, can aid in early detection of such threats.
The SMOKE#SCREEN campaign highlights the growing trend of cyber attackers leveraging legitimate tools for malicious purposes. By disguising their activities as routine IT operations, these attackers can infiltrate systems undetected, emphasizing the need for organizations to adopt comprehensive monitoring and validation processes for software installations and remote access tools.
