Smoke#Screen Campaign Abuses ScreenConnect for Stealthy Cross-Platform Access

Researchers reported an active Smoke#Screen social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed ScreenConnect remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both Windows and macOS users and uses multiple lures, including fake Zoom and Adobe updates, document-review requests, and a SystemCheck maintenance tool. Securonix linked the activity to a live staging server at 207.174.0.143:8080, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters.

The attackers rotated payloads between download sessions and used a mix of VBScript droppers, batch loaders, compiled .NET executables, phishing HTML pages, Dropbox links, Cloudflare Quick Tunnels, encrypted bundles, and a WsgiDAV staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that behavioral detection is more effective than relying on software trust or static indicators alone.