Cyberattackers are mounting a social engineering campaign to compromise organizations via the legitimate ScreenConnect Remote Monitoring and Management (RMM) tool, in an effort that takes the RMM playbook to new frontiers.
The Smoke#Screen campaign, named by the researchers at Securonix who discovered it, uses lures related to purported Zoom and Adobe “updates,” business document requests, and system-maintenance tools. Victims who execute any of the initial access files end up with a fully functional ScreenConnect agent silently installed and beaconing to one of three attacker-controlled relay servers, providing the threat actor with persistent, legitimate-looking remote access to compromised hosts, according to a report published today.
While abusing RMM tools has become an increasingly common way for attackers to bypass security controls and maintain persistence on compromised systems, the campaign, which targets both Windows and macOS systems, demonstrates “a clear evolution over time,” according to the Securonix researchers. Aaron Beardslee, manager of threat research at Securonix, tells Dark Reading that Smoke#Screen is distinctive for several key reasons.
Two of those have to do with both rotating payloads and the lures used to hook in victims. “The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live … staging server,” according to the report, And while it’s common practice now for attackers to rotate malware payloads, the attacker’s practice of rotating them between individual download sessions is unusual, Beardslee says.
The campaign’s lure strategy is similarly distinctive in that attackers used four psychologically different contexts, rather than recycling variations of one social engineering theme, showing sophistication, Beardslee says. Zoom and Adobe updates target consumer habits on unmanaged or bring-your-own-device (BYOD) systems; document-review lures exploit routine enterprise email behavior; and a “SystemCheck” maintenance-tool lure is designed so that a User Account Control (UAC) prompt appears legitimate.
Attackers likely used a wide swath of lures “to maximize the population of potential victims,” and also actively rotated payload hashes below download sessions to make “hash-based detection ineffective across multiple investigative sampling periods,” according to the report.
Cybercrime OpSec Fail: A Peek Behind the Smoke#Screen Curtain
Securonix’s investigation began with a single VBScript dropper (zoom-update.vbs) submitted to its telemetry, which the researchers tracked to an active staging server hosting a full arsenal of 15 unique payloads.
“By mapping the infrastructure and performing analysis on all collected samples, we were able to reconstruct five distinct kill chains, identify three separate ScreenConnect relay servers, and document how the actor’s techniques evolved from their earliest cautious samples to their current most aggressive configuration,” the researchers wrote.
In fact, what allowed the researchers to investigate so comprehensively is that the attackers exposed much of their attack process, Beardslee says. “They left their C# source code sitting on an open directory next to the compiled builds, so we didn’t have to guess at their development process, we could read it,” he explains.
Through this open window, the researchers observed features getting added between versions, two binaries turning out to be the same file with different names, and the use of “Dropbox for reputation, a Cloudflare Quick Tunnel for anonymity, and a real ConnectWise DigiCert signature on the payload itself, where each layer beats a different control and no single control ever sees the whole stack,” Beardslee says.
This visibility also had the researchers scratching their heads at some of the operator’s sequence of events, which seemed to contradict themselves, he adds, with behaviors that didn’t seem to belong to the same operator, “and that is worth paying attention to,” he says, stopping short of saying more than one attack cluster was behind the campaign. Instead, the researchers attributed it to “a capable, actively maintained, and rapidly adapting threat actor who has built a diversified toolkit,” they wrote.
How Cyber Defenders Prevent Remote Management Compromise
It’s clear that attackers plan to continue to use RMM tools as an attack vector, mainly because it’s so hard to detect by security teams. “The payload isn’t malware, and that’s the whole problem,” Beardslee says. “There’s no C2 protocol to signature, no unsigned binary, no injected process, nothing weird in the process tree after install, just a properly signed ConnectWise service doing exactly what ConnectWise built it to do, which happens to include full interactive desktop control and a credential provider DLL.”
To help organizations defend against this type of evasion, they should ensure that behavioral detections for Defender tampering, unauthorized RMM installations, ScreenConnect connections to raw IP addresses, and anti-endpoint detection and response (EDR) timing patterns are in place, according to the report.
Other defense tips include ensuring that UAC is set to “Always notify” and preventing standard users from bypassing UAC prompts for administrative tasks; and implementing behavioral EDR rules that detect anomalous parent-child process relationships, such as powershell.exe or cmd.exe launching msiexec.exe with silent installation flags, according to Securonix.
For Smoke#Screen in particular, the threat actor’s use of Cloudflare tunnels, Dropbox, ConnectWise-signed binaries, and self-contained encrypted bundles as evasion mechanisms means that signature and reputation-based controls alone are insufficient. Therefore, the researchers added, behavioral detection remains the most reliable path to catching this activity.
