Fake Adobe and Zoom Updates Deliver ScreenConnect for Persistent Remote Access

Cybersecurity researchers have uncovered an active, multi-wave campaign that uses social engineering lures themed around Adobe and Zoom updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) tools like ConnectWise ScreenConnect. The campaign, dubbed SMOKE#SCREEN by Securonix Threat Research, employs a toolkit of VBScript droppers, batch file loaders, compiled .NET executables, and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080.

Successful attacks culminate with a ScreenConnect agent installed and beaconing to one of three attacker-controlled relay servers, providing persistent remote access to compromised systems. The activity has not been attributed to any known threat actor or group. The findings add to the growing abuse of legitimate RMM tools by threat actors, allowing them to bypass security controls and blend in with authorized IT tooling.

Securonix said its investigation commenced following the discovery of a live WsgiDAV server that served two purposes: staging malicious payloads and maintaining command-and-control (C2) over infected machines through a ScreenConnect relay on port 8041. An analysis of the ScreenConnect relay configuration strings embedded in the MSI and EXE payloads uncovered three distinct C2 clusters, each associated with software update, document review, and document viewer decoy binaries.

The initial access vector is assessed to be spear-phishing, with emails serving as a conduit for an obfuscated Visual Basic Script (VBScript) dropper that performs environment and anti-analysis checks to ensure safe execution. It enumerates running processes and aborts if security or virtualization tools like Wireshark, Process Monitor, Oracle VM VirtualBox, VMware Tools, Citrix XenServer, or Fiddler Classic are detected. If checks pass, the script decrypts a PowerShell command that fetches a C# payload from 207.189.11[.]170 and executes it.

Alternative attack paths use business-themed lures to trick recipients into running a VBScript that leads to ScreenConnect installation. A third sample is delivered as a compressed archive, from which a batch script disables Windows Antimalware Scan Interface (AMSI), escalates privileges via User Account Control (UAC) prompts, turns off SmartScreen protections via Registry modifications, and removes the Zone.Identifier alternate data stream (ADS) from the downloaded MSI file before running it.

The actor’s delivery strategy has rotated across multiple trusted hosting services. An early phishing page (‘zoom-update.html’) delivered its payload via a Dropbox shared link, bypassing domain reputation filters. A compiled .NET loader (‘MemoryLoader.cs’) references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service rarely monitored. The staging server runs cloudflared.exe, confirming the actor uses the Cloudflare binary directly on their infrastructure to generate ephemeral tunnels.

Regardless of the lure, all attack paths lead to the installation of a ScreenConnect client that connects to a configured relay server, allowing the operator to open a remote desktop session with the victim’s machine. Securonix noted the campaign’s observable arc of tradecraft, from cautious XOR-encrypted VBScript droppers to aggressive nine-step Defender destruction sequences, and a recent pivot back to stealth with anti-EDR timing and self-contained encrypted bundles.

To counter the threat, organizations are recommended to restrict execution of untrusted MSI files, monitor for processes attempting to tamper with security products, audit legitimate use of RMM tools, check for suspicious PowerShell and cmd.exe processes, and enforce strict UAC settings to prevent standard users from bypassing UAC prompts.