Cloudflare Quick Tunnel Used for Malicious Payload Staging
Attackers in the SMOKE#SCREEN campaign used Cloudflare Quick Tunnel to expose a staging server temporarily, leveraging a service that is rarely monitored.…
Tag: SMOKE#SCREEN
WsgiDAV Server Used as Malicious Staging and C2 Infrastructure
The SMOKE#SCREEN campaign used a live WsgiDAV-based server to stage malicious payloads and maintain command-and-control over infected machines via a ScreenConnect relay…
Fake Adobe and Zoom Updates Deliver ScreenConnect for Persistent Remote Access
Cybersecurity researchers have uncovered an active, multi-wave campaign that uses social engineering lures themed around Adobe and Zoom updates, business document reviews,…
ScreenConnect: Legitimate RMM Tool Abused for Persistent Remote Access
ScreenConnect, a remote monitoring and management (RMM) tool by ConnectWise, is being abused by threat actors in the SMOKE#SCREEN campaign to gain…
Securonix Uncovers SMOKE#SCREEN Campaign
Securonix Threat Research discovered and analyzed the SMOKE#SCREEN campaign, which uses social engineering lures to deploy ScreenConnect for persistent remote access. The…