As reported by Security Affairs, Securonix Threat Research has been actively tracking a multi-wave intrusion campaign dubbed SMOKE#SCREEN — a sophisticated operation that weaponizes legitimate remote management tooling to maintain persistent, stealthy footholds inside victim environments. This campaign deserves serious attention from defenders, not because the techniques are novel, but because they are increasingly effective at defeating conventional security controls.

Threat Alert: As reported by Security Affairs, Securonix Threat Research has been actively tracking a multi-wave intrusion campaign dubbed SMOKE#SCREEN — a sophisticated operation that weaponizes legitimate remote management tooling to maintain persistent, stealthy footholds inside victim environments.

Why This Campaign Is More Dangerous Than It Looks

At first glance, SMOKE#SCREEN may appear to be a straightforward phishing campaign. But the operational detail here is what matters: attackers are not dropping custom malware that can be fingerprinted and detected by endpoint security tools. Instead, they are delivering ConnectWise ScreenConnect — a commercially licensed, digitally signed remote monitoring and management (RMM) tool used by thousands of legitimate IT teams every day.

This is the core genius of the approach. When an EDR or antivirus solution sees ScreenConnect executing on an endpoint, it faces an immediate attribution challenge. Is this the IT department running a remote support session? Or is it a threat actor who just silently installed it via a fake Zoom update? Most security tools default to trust — and attackers know it.

The abuse of legitimate RMM software has become one of the most reliable evasion techniques in the modern attacker's playbook. It's not a bug in our defenses — it's a feature attackers are deliberately exploiting.

The Broader Trend: Living Off Trusted Software

SMOKE#SCREEN fits squarely into a well-documented and growing trend that CISA, NSA, and international partners formally warned about in a 2023 advisory: the malicious use of legitimate RMM tools. Threat actors — ranging from cybercriminal groups running tech support scams to nation-state APTs — have consistently pivoted toward tools like ScreenConnect, AnyDesk, TeamViewer, and Atera as their preferred remote access mechanisms. Why develop a custom backdoor when a signed, trusted commercial tool provides equivalent capability with a fraction of the detection risk?

The social engineering lures used in SMOKE#SCREEN — fake Zoom updates, Adobe notices, business document reviews, system maintenance utilities — are deliberately rotated. This rotation is a strong indicator of a mature, operationally disciplined threat actor who is actively monitoring detection rates and adapting their initial access mechanisms accordingly.

Who Is Most at Risk

The Broader Trend: Living Off Trusted Software
Organizations with limited endpoint visibility that cannot distinguish authorized RMM deployments from unauthorized ones
Remote or hybrid workforces conditioned to accept IT-related update prompts without verification
SMBs and mid-market organizations that rely on perimeter-focused defenses without robust behavioral detection
Environments where ScreenConnect or similar RMM tools are already in use — making malicious installations even harder to isolate
Finance, legal, and professional services firms where business document lures are highly believable

The Persistent Access Problem

Once ScreenConnect is installed via this campaign, attackers achieve something of significant strategic value: persistence that survives reboots and doesn't require ongoing interaction. Unlike a malware implant that must beacon out and risk detection, a running RMM agent simply waits for the attacker to connect — on their schedule, not the defender's. This dramatically extends the window of attacker opportunity for lateral movement, credential harvesting, and data exfiltration.

Shield53 Recommendations

Immediate Actions

  • Audit all RMM software installations across your environment immediately. Build an authorized software inventory and flag any ScreenConnect, AnyDesk, or similar agents not provisioned by your IT team.
  • Implement application allowlisting or strict software installation policies that prevent users from installing RMM tools without administrative approval.
  • Block or alert on ScreenConnect's default installation paths and network beaconing to ConnectWise cloud relay infrastructure unless explicitly authorized.
  • Train your workforce specifically on fake software update lures — these campaigns succeed because users are conditioned to click update prompts. Reinforce verification through official channels.

Detection Guidance

  • Hunt for ScreenConnect processes spawned from unusual parent processes (browsers, email clients, Office applications).
  • Alert on ScreenConnect installations originating from user-writable directories (Downloads, Temp, AppData).
  • Monitor for new RMM-related services or scheduled tasks created outside of your standard change management window.
  • Correlate ScreenConnect network connections against your authorized RMM server inventory — unknown relay endpoints are a strong indicator of compromise.

Strategic Controls

  • Adopt a formal RMM governance policy — document every authorized tool, version, and deployment method.
  • Require MFA on all RMM platforms and restrict access to named administrator accounts only.
  • Integrate threat intelligence feeds that track RMM abuse indicators into your SIEM/SOAR workflows.

SMOKE#SCREEN is a reminder that in modern intrusion campaigns, the most dangerous tools are often the ones you already trust. Defenders must evolve their detection philosophy to account for this reality — legitimate software can be malicious infrastructure, and the only way to tell the difference is context, visibility, and behavioral analysis.