As reported by The Hacker News, active research from Securonix Threat Intelligence has uncovered a sophisticated, multi-wave social engineering campaign — dubbed SMOKE#SCREEN — that exploits the trusted reputations of Adobe and Zoom to deliver ConnectWise ScreenConnect as a persistent remote access tool. What makes this campaign particularly dangerous isn't the malware itself — it's the strategy.
Why This Campaign Is More Dangerous Than It Appears
At first glance, deploying a legitimate RMM tool might seem less alarming than dropping a traditional RAT or ransomware payload. That instinct is exactly what the threat actors are counting on. ScreenConnect is a commercially licensed, widely used remote management platform. In many enterprise environments, it generates no alerts whatsoever — because IT teams use it every day. This is the hallmark of a living-off-the-land approach applied to the software supply chain trust problem.
The attackers are essentially laundering their access through a legitimate tool. Once installed, they have a persistent, encrypted remote foothold that security teams may not flag for days, weeks, or ever — especially in organizations without robust application allowlisting or RMM governance policies.
The Social Engineering Kill Chain
The lure diversity in SMOKE#SCREEN is worth emphasizing. This isn't a single phishing template. The campaign reportedly rotates through multiple pretexts:
This multi-pretext approach signals a well-resourced, adaptable threat actor — one that tests and rotates lures to maximize conversion rates across different victim profiles and industries. Organizations in professional services, finance, and any sector with active document exchange workflows should consider themselves squarely in the target zone.
The RMM Abuse Problem Is Getting Worse
SMOKE#SCREEN is not an isolated incident. The abuse of legitimate RMM tools — including ScreenConnect, AnyDesk, Atera, and others — has become a defining characteristic of modern intrusion campaigns. CISA, NSA, and MS-ISAC have previously issued joint advisories specifically warning about RMM abuse as an initial access and persistence vector. The SMOKE#SCREEN campaign is yet another data point confirming that threat actors have fully operationalized this technique.
Shield53 Perspective: The fundamental problem is that many organizations lack a definitive, enforced policy on which RMM tools are authorized, on which systems, and installed by whom. Without that baseline, defenders cannot distinguish a legitimate help desk session from an attacker's persistent backdoor.
Who Is Most at Risk
Any organization that relies heavily on end-user-initiated software updates — without centralized patch management — is exposed. Key risk factors include:
- Environments where users have local administrator rights
- Organizations without application allowlisting or software restriction policies
- Companies lacking RMM governance or an authorized tool inventory
- Industries with high document exchange volume (legal, finance, healthcare, staffing)
- Hybrid/remote workforces accustomed to self-service IT tooling
Shield53 Recommendations
Immediate Actions
- Audit RMM tool deployments now. Enumerate every instance of ScreenConnect, AnyDesk, Atera, TeamViewer, and similar tools across your environment. Anything not deployed through authorized channels or outside your CMDB should be treated as suspicious.
- Implement application allowlisting. Tools like Microsoft AppLocker or Windows Defender Application Control (WDAC) can prevent unauthorized RMM installers from executing, even if a user downloads them.
- Restrict local admin rights. The majority of these social engineering attacks require elevated privileges to install software. Enforcing least-privilege access dramatically reduces impact.
- Train users on update authenticity. Legitimate software updates from Adobe, Zoom, and similar vendors come through the application itself or an enterprise patch management system — never from a browser pop-up or unsolicited download link.
Detection Guidance
- Alert on ScreenConnect or other RMM tools installed outside of authorized deployment mechanisms (e.g., installed from user temp directories, AppData, or Downloads folders)
- Monitor for RMM processes establishing outbound connections to non-corporate relay infrastructure
- Flag processes spawned by RMM agents that execute scripting engines (PowerShell, cmd, wscript) — a strong indicator of post-access activity
- Review EDR telemetry for RMM installer hashes against your authorized software baseline
Strategic Controls
- Establish a formal RMM Governance Policy defining authorized tools, approved use cases, and mandatory logging requirements
- Integrate RMM session logs into your SIEM for anomaly detection — unusual hours, unexpected endpoints, or new installations should trigger review
- Engage your user community with targeted awareness content on fake update lures — this specific pretext continues to be highly effective
SMOKE#SCREEN is a reminder that attackers don't always need sophisticated malware when legitimate tools — and human trust — will do the job just as well. Defense here is less about signature detection and more about governance, visibility, and a well-trained workforce.
