As reported by Dark Reading, a newly documented campaign dubbed Smoke#Screen is leveraging legitimate remote monitoring and management (RMM) software — specifically ConnectWise ScreenConnect — as a post-phishing persistence mechanism. While the surface-level story is another phishing campaign, the deeper implications for enterprise defenders are significant and warrant urgent attention.
Why RMM Abuse Is a Category-Defining Threat
What makes Smoke#Screen particularly instructive is not just the tools being used, but the strategic logic behind them. Threat actors have clearly internalized a core lesson from years of endpoint detection evolution: legitimate software is harder to kill than malware. ScreenConnect, AnyDesk, Atera, and similar RMM platforms are routinely whitelisted in enterprise environments, trusted by security controls, and rarely flagged by EDR solutions out of the box. Deploying them as implants is, from an attacker's perspective, elegant — and from a defender's perspective, genuinely difficult to detect at scale.
This campaign follows a well-worn but continuously refined playbook: diverse social engineering lures (invoice fraud, IT helpdesk impersonation, HR communications) funnel victims into executing an installer that drops a fully functional RMM agent. Once installed, the attacker gains persistent, encrypted, interactive access to the victim machine — functionally equivalent to having a technician sitting at the keyboard, but invisible to most network monitoring tools.
Shield53 Analyst Note: RMM-as-implant attacks are particularly dangerous in SMB environments where IT staff may not have visibility into what RMM agents are installed, or where IT teams themselves use these tools legitimately — creating perfect cover for malicious instances.
The Rotating Payload Problem
The use of rotating payloads — changing delivery mechanisms and lure types across attack waves — signals an operationally mature threat actor conducting active A/B testing of their intrusion chain. This isn't spray-and-pray phishing; it's a deliberate methodology designed to identify which lures bypass specific organizational controls. Defenders who rely solely on signature-based email filtering or static IOC blocklists will find themselves perpetually one step behind this approach.
The rotation strategy also complicates threat intelligence sharing. By the time IOCs are extracted, shared, and operationalized across the security community, the attacker has already pivoted to a new payload variant. This underscores the need to shift detection focus from what the malware is to how it behaves post-execution.
Who Is Most at Risk
Broader Implications: The CISA RMM Warning Revisited
CISA and the NSA issued a joint advisory in 2023 specifically warning about the abuse of RMM software in phishing campaigns — and Smoke#Screen confirms that threat actors not only read that playbook, they're continuing to refine it. The persistence of this technique two-plus years later suggests the security industry has not adequately solved the detection and prevention problem. Many organizations still lack an authoritative, maintained inventory of which RMM agents are authorized, on which endpoints, installed by whom.
Shield53 Recommendations
Immediate Actions
- Audit all RMM agent installations across your environment immediately. Any agent not in your authorized software inventory should be treated as suspect and investigated.
- Implement application allowlisting or at minimum application control policies that require IT approval before RMM agents can be installed.
- Block unauthorized RMM infrastructure at the network perimeter. Create DNS/firewall blocklists for RMM relay domains not associated with your approved vendors.
- Enable behavioral detection rules in your EDR for RMM agent installation events — particularly those triggered by user-space processes rather than IT management systems.
Strategic Controls
- Establish and enforce a formal RMM governance policy that defines approved tools, approved relay infrastructure, and mandatory logging requirements for all remote sessions.
- Deploy email security controls with attachment sandboxing capable of executing and analyzing installer payloads before delivery.
- Train users specifically on IT helpdesk impersonation lures — this threat pattern is consistently exploited and often succeeds because it feels authoritative.
- Integrate MITRE ATT&CK T1219 (Remote Access Software) detection logic into your SIEM to correlate RMM installation events with other suspicious telemetry.
Smoke#Screen is a timely reminder that the most dangerous tools in an attacker's kit are often the ones your own IT team uses every day. Defenders must close the gap between legitimate IT tooling and its potential for abuse — before attackers exploit it further.
