Overview
The SMOKE#SCREEN campaign demonstrates how attackers can weaponize legitimate remote monitoring and management (RMM) tools like ScreenConnect and disguise delivery through Cloudflare Quick Tunnels. Victims are tricked into installing what looks like routine updates or business files, but instead unknowingly grant attackers remote access to their systems.
Attack Chain
- Phishing lures: Fake Zoom updates, Adobe downloads, and document reviews.
- Silent RMM installation: Victims install ScreenConnect, giving attackers desktop control and file access.
- Cloudflare tunnels: Temporary routes obscure payload hosting, complicating detection.
- Cross‑platform payloads: Both Windows and macOS installers connect to the same relay infrastructure.
Evolution of Techniques
- Early waves: Aggressive loaders attempted to disable Windows protections, elevate privileges, and erase traces.
- Later waves: Operators shifted to stealth, delaying service start to evade correlation by security products.
- Frequent file changes: Hash‑based blocking became ineffective as payloads were constantly updated.
Social Engineering Tactics
- Fake Zoom update pages auto‑started downloads after short delays.
- Adobe Flash Player prompts mimicked legitimate update notices.
- Victims moved from a single click to full RMM installation with minimal warning.
Indicators of Compromise (IoCs)
- Relay servers:
207.174.0.143:8080,142.202.191.225:8041,blog.derrspecial-onlinedmin.live:8041. - Payloads:
zoom-update.vbs,SystemCheck.msi,AdobeReader_Update.exe,ZoomUpdateInstaller.pkg. - Domains:
crestmarkhq.com,subscription-magnetic-recommended-meat.trycloudflare.com. - Hashes: Multiple VBScript, MSI, and executable loaders tied to Zoom and Adobe themes.
Defensive Guidance
- Restrict MSI installers from user‑writable folders.
- Enforce strict UAC to block silent privilege escalation.
- Monitor script launches: PowerShell or command shells starting installers should raise alerts.
- Inventory approved RMM tools: Block unauthorized ScreenConnect clients.
- Investigate Defender tampering: Unexpected setting changes or delays after installation may signal compromise.
Expert in the Cloud Insight
SMOKE#SCREEN highlights the shift from disabling defenses to hiding activity. By abusing trusted RMM tools and disguising delivery through Cloudflare tunnels, attackers blur the line between legitimate IT support and covert intrusion. For defenders, the lesson is clear: security must focus on context — who installed the RMM, where it connects, and whether the activity aligns with approved operations.
Leave a Reply