Securonix Threat Research discovered and analyzed the SMOKE#SCREEN campaign, which uses social engineering lures to deploy ScreenConnect for persistent remote access. The research highlights the abuse of legitimate RMM tools and the evolving tradecraft of the attackers.