Pierluigi Paganini
August 05, 2026
Securonix Threat Research has been tracking an active multi-wave campaign they’ve named SMOKE#SCREEN, in which unknown attackers use rotating social engineering lures, fake Zoom updates, Adobe software notices, business document reviews, system maintenance utilities, to silently install ConnectWise ScreenConnect on victim machines.
ScreenConnect is a legitimate remote monitoring and management tool used by IT teams worldwide. Once installed, it gives the attacker persistent full remote access that looks exactly like authorized IT activity. That’s the point.
“The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0.143:8080.” reads the report published by Securonix. “Victims who execute any of the initial access files end up with a fully functional ScreenConnect agent silently installed and beaconing to one of three attacker-controlled relay servers, providing the threat actor with persistent, legitimate-looking remote access to compromised hosts.”
Researchers found a live server hosting the malicious files, while frequent payload changes help attackers avoid detection based only on file hashes.
Securonix found the staging server by following a single VBScript dropper named zoom-update.vbs, and when they looked at it, the entire directory was openly browsable, exposing 15 payload files. The same IP address (207.174.0[.]143) that hosts the staging server also runs the primary ScreenConnect relay on port 8041. One machine delivering payloads and maintaining remote control over already-compromised hosts. Efficient.
The campaign has evolved significantly since its earliest samples, and tracking that evolution tells you more about the attacker than any single sample would. The first VBScript dropper used XOR encryption, a state machine execution flow to confuse static analysis, junk arithmetic operations to alter byte signatures between builds, and environment checks that abort if the machine has less than 2 GB of RAM or runs analysis tools like Wireshark or Process Monitor.
The third sample abandoned all that subtlety and went fully aggressive: a batch file that disables AMSI via memory patching, re-launches itself with a UAC prompt disguised as a system maintenance tool, kills SmartScreen through registry modifications, adds the entire C:\ drive as a Defender exclusion path, stops and permanently disables the WinDefend service, and strips the Zone.Identifier stream from the downloaded MSI before running it silently.
“The actor’s delivery strategy has also rotated across multiple trusted hosting services. An early phishing page (zoom-update.html) delivers its payload via a Dropbox shared link, bypassing domain reputation filters since Dropbox is an allow-listed platform in most corporate environments. A compiled .NET loader (MemoryLoader.cs) references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure that is rarely monitored.” continues the report. “The staging server itself runs cloudflared.exe, confirming that the actor uses the Cloudflare binary directly on their infrastructure to generate these ephemeral tunnels.”
The researchers noted that the fake Zoom update HTML page is particularly polished: correct logo SVG, correct brand color hex code, a fake version number, urgency messaging about secure connections failing, and a JavaScript timer that triggers the download automatically after two seconds, no click required. The page then instructs the victim to run the downloaded MSI to complete the update. By the time they do, the attacker already has a relay waiting.
The most significant finding came when Securonix observed a major payload rotation mid-investigation. The actor replaced their aggressive MemoryLoader.cs, which executed a nine-step Defender destruction sequence within 15 seconds of execution, with a new loader.cs that takes the opposite approach: avoid detection entirely instead of destroying controls.
“The most revealing addition is an explicit comment in the source code:
// WAIT 3 MINUTES (Breaks Elastic correlation)
Thread.Sleep(180000);
The actor is deliberately introduced a 180-second delay between MSI installation and service start to break EDR event correlation windows, and they are targeting Elastic specifically.” continues the report. “This is direct evidence of adversary testing against commercial security products. The removal of the entire Defender destruction sequence strongly suggests those behavioral detections were working. The actor has pivoted from a “destroy the AV” to an “avoid the AV” strategy.
The removal of the Defender destruction sequence in the new version strongly suggests those behavioral detections were working. The attacker noticed, adapted, and published cleaner code. The campaign also has a macOS variant: ZoomUpdateInstaller.pkg connects to the same primary relay server as the Windows MSIs.
The final payload in every attack path is a legitimate ConnectWise-signed ScreenConnect MSI, signed with a valid DigiCert certificate chain.
“All MSI files are signed with a valid Authenticode certificate issued to Connectwise, LLC by DigiCert’s trusted root chain. This is the most significant evasion technique in the arsenal, many EDR products apply reduced scrutiny to binaries signed by recognized enterprise software vendors, and ScreenConnect in particular is a known legitimate RMM tool used by IT teams worldwide.” states Securonix.
“Once installed, each agent silently connects to its configured relay server with the URL parameters e=Access&y=Guest, presenting as a guest access connection. The threat actor uses the relay server to establish a remote desktop session with the victim’s machine.”
The practical detection guidance from Securonix focuses on behavior rather than signatures: alert on processes stopping WinDefend, adding C:\ as a Defender exclusion path, or installing MSIs from %TEMP% or AppData. Block unauthorized RMM tools connecting to raw IP addresses rather than vendor domains. And treat any ScreenConnect connection to an IP address rather than a ConnectWise subdomain as a red flag worth investigating immediately.
“The SMOKE#SCREEN campaign demonstrates a capable, actively maintained, and rapidly adapting threat actor who has built a diversified toolkit around a single objective: gaining persistent, legitimate-looking remote access to victim systems through weaponized ScreenConnect deployments.” concludes the report. “What makes this campaign particularly notable for defenders is the observable arc of the actor’s tradecraft. From cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences and then, most recently, a pivot back to stealth with anti-EDR timing and self-contained encrypted bundles, the campaign reads like a real-time arms race between attacker and defender. “
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SMOKE#SCREEN)
