Actor Profile

SMOKE#SCREEN is an unattributed multi-wave campaign active as of August 2026 that leverages social engineering to deploy ConnectWise ScreenConnect RMM software for persistent remote access. The campaign is not currently linked to any known threat actor or group. The operators demonstrate evolving tradecraft, rotating between stealth-focused XOR-encrypted VBScript droppers and aggressive Windows Defender evasion sequences, suggesting active adaptation to defensive measures. The campaign uses a WsgiDAV-based staging server (207.174.0[.]143:8080) and maintains three distinct C2 clusters associated with different decoy themes (software updates, document reviews, system utilities).

TTPs (Tactics, Techniques, Procedures)

Initial access via spear-phishing emails delivering obfuscated VBScript droppers (T1566.001, T1059.005). Anti-analysis checks enumerate running processes to detect sandbox environments including Wireshark, Process Monitor, VirtualBox, VMware Tools, XenServer, and Fiddler (T1497). PowerShell used to fetch and execute C# payloads from remote infrastructure (T1059.001). Batch scripts disable Windows AMSI (T1562.001), escalate privileges via UAC prompts (T1548.002), disable SmartScreen via Registry modifications (T1112), and remove Zone.Identifier ADS from downloaded files (T1564.004). Abuse of legitimate RMM tool (ConnectWise ScreenConnect) for C2 and remote desktop access (T1219). Infrastructure leverages trusted hosting services (Dropbox, Cloudflare Quick Tunnels) for payload delivery and ephemeral C2 tunneling to evade domain reputation filters (T1102).

Targets & Patterns

The campaign does not appear to target specific sectors or geographic regions based on available data. The use of generic business-themed lures (Adobe/Zoom updates, document reviews, system maintenance utilities) and distribution via spear-phishing suggests opportunistic targeting of enterprise environments. The selection of ScreenConnect as the RMM tool indicates focus on organizations where legitimate IT remote management tools are commonly deployed, allowing the attackers to blend in with authorized administrative activity. The reliance on social engineering and trusted hosting platforms (Dropbox, Cloudflare) suggests targeting of organizations with standard security controls that allowlist common cloud services.

Historical Context

SMOKE#SCREEN represents part of a broader trend of threat actors abusing legitimate RMM tools to bypass security controls and avoid deploying custom remote access trojans. The campaign's observable evolution—from XOR-encrypted VBScript droppers to aggressive Windows Defender destruction sequences, then pivoting back to stealth with anti-EDR timing and self-contained encrypted bundles—demonstrates real-time adaptation to defensive measures. This pattern of iterative tradecraft refinement suggests an active campaign responding to detection and mitigation efforts. The use of WsgiDAV staging servers and Cloudflare Quick Tunnels for ephemeral C2 infrastructure reflects increasing sophistication in evading network-based detection.

Defensive Recommendations

  • Restrict execution of untrusted MSI and EXE files via application control policies (AppLocker, WDAC) to prevent unauthorized ScreenConnect installations
  • Monitor for T1562.001 defense evasion: detect Registry modifications to disable AMSI, SmartScreen, and Windows Defender via Sysmon Event ID 13 (RegistryEvent) targeting keys under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
  • Audit and baseline legitimate RMM tool usage (ScreenConnect, TeamViewer, AnyDesk); alert on new ScreenConnect relay connections to non-corporate infrastructure, particularly on non-standard ports like 8041
  • Detect T1059.001 and T1059.005: monitor for suspicious PowerShell and VBScript execution, especially processes spawned from email clients or user temp directories, using enhanced PowerShell logging (Event ID 4104) and script block logging
  • Block or monitor access to WsgiDAV servers and Cloudflare Quick Tunnel domains (*.trycloudflare.com) at the network perimeter; inspect outbound connections to cloudflared.exe processes not associated with authorized services
  • Enforce strict UAC settings (ConsentPromptBehaviorAdmin=2) to prevent standard users from bypassing elevation prompts; monitor Event ID 4688 for elevation attempts from unexpected parent processes