Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources CYBERATTACKS & DATA BREACHES CYBER RISK CYBERSECURITY OPERATIONS ENDPOINT SECURITY NEWS Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks. Elizabeth Montalbano,Contributing Writer August 4, 2026 4 Min Read SOURCE: IVELIN RADKOV VIA ALAMY STOCK PHOTO Cyberattackers are mounting a social engineering campaign to compromise organizations via the legitimate ScreenConnect Remote Monitoring and Management (RMM) tool, in an effort that takes the RMM playbook to new frontiers. The Smoke#Screen campaign, named by the researchers at Securonix who discovered it, uses lures related to purported Zoom and Adobe "updates," business document requests, and system-maintenance tools. Victims who execute any of the initial access files end up with a fully functional ScreenConnect agent silently installed and beaconing to one of three attacker-controlled relay servers, providing the threat actor with persistent, legitimate-looking remote access to compromised hosts, according to a report published today. LOADING... While abusing RMM tools has become an increasingly common way for attackers to bypass security controls and maintain persistence on compromised systems, the campaign, which targets both Windows and macOS systems, demonstrates "a clear evolution over time," according to the Securonix researchers. Aaron Beardslee, manager of threat research at Securonix, tells Dark Reading that Smoke#Screen is distinctive for several key reasons. Related:Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm Two of those have to do with both rotating payloads and the lures used to hook in victims. "The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live … staging server," according to the report, And while it's common practice now for attackers to rotate malware payloads, the attacker's practice of rotating them between individual download sessions is unusual, Beardslee says. The campaign's lure strategy is similarly distinctive in that attackers used four psychologically different contexts, rather than recycling variations of one social engineering theme, showing sophistication, Beardslee says. Zoom and Adobe updates target consumer habits on unmanaged or bring-your-own-device (BYOD) systems; document-review lures exploit routine enterprise email behavior; and a "SystemCheck" maintenance-tool lure is designed so that a User Account Control (UAC) prompt appears legitimate. Attackers likely used a wide swath of lures "to maximize the population of potential victims," and also actively rotated payload hashes below download sessions to make "hash-based detection ineffective across multiple investigative sampling periods," according to the report. LOADING... Cybercrime OpSec Fail: A Peek Behind the Smoke#Screen Curtain Securonix's investigation began with a single VBScript dropper (zoom-update.vbs) submitted to its telemetry, which the researchers tracked to an active staging server hosting a full arsenal of 15 unique payloads. Related:Who's Liable When AI Agents Escape? Hugging Face Breach Raises Hard Questions "By mapping the infrastructure and performing analysis on all collected samples, we were able to reconstruct five distinct kill chains, identify three separate ScreenConnect relay servers, and document how the actor's techniques evolved from their earliest cautious samples to their current most aggressive configuration," the researchers wrote. In fact, what allowed the researchers to investigate so comprehensively is that the attackers exposed much of their attack process, Beardslee says. "They left their C# source code sitting on an open directory next to the compiled builds, so we didn't have to guess at their development process, we could read it," he explains. Through this open window, the researchers observed features getting added between versions, two binaries turning out to be the same file with different names, and the use of "Dropbox for reputation, a Cloudflare Quick Tunnel for anonymity, and a real ConnectWise DigiCert signature on the payload itself, where each layer beats a different control and no single control ever sees the whole stack," Beardslee says. Related:Hugging Face Hack: Lessons for Cyber Defenders This visibility also had the researchers scratching their heads at some of the operator's sequence of events, which seemed to contradict themselves, he adds, with behaviors that didn't seem to belong to the same operator, "and that is worth paying attention to," he says, stopping short of saying more than one attack cluster was behind the campaign. Instead, the researchers attributed it to "a capable, actively maintained, and rapidly adapting threat actor who has built a diversified toolkit," they wrote. How Cyber Defenders Prevent Remote Management Compromise It's clear that attackers plan to continue to use RMM tools as an attack vector, mainly because it's so hard to detect by security teams. "The payload isn't malware, and that's the whole problem," Beardslee says. "There's no C2 protocol to signature, no unsigned binary, no injected process, nothing weird in the process tree after install, just a properly signed ConnectWise service doing exactly what ConnectWise built it to do, which happens to include full interactive desktop control and a credential provider DLL." To help organizations defend against this type of evasion, they should ensure that behavioral detections for Defender tampering, unauthorized RMM installations, ScreenConnect connections to raw IP addresses, and anti-endpoint detection and response (EDR) timing patterns are in place, according to the report. Other defense tips include ensuring that UAC is set to "Always notify" and preventing standard users from bypassing UAC prompts for administrative tasks; and implementing behavioral EDR rules that detect anomalous parent-child process relationships, such as powershell.exe or cmd.exe launching msiexec.exe with silent installation flags, according to Securonix. For Smoke#Screen in particular, the threat actor's use of Cloudflare tunnels, Dropbox, ConnectWise-signed binaries, and self-contained encrypted bundles as evasion mechanisms means that signature and reputation-based controls alone are insufficient. Therefore, the researchers added, behavioral detection remains the most reliable path to catching this activity. About the Author Elizabeth Montalbano Contributing Writer Elizabeth Montalbano is freelance writer, editor, and journalist with 30 years of professional experience and a master's degree from Arizona State University. Her areas of expertise include enterprise technology, cybersecurity, business, and culture. During her long career, Elizabeth has lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City. She specializes in news coverage and analysis, using her years of experience to look at the current state of cybersecurity with a critical gaze. She currently resides in a village on the southwest coast of Portugal, where in her free time she enjoys surfing, hiking with her dogs, growing plants, and playing and performing as a singer and musician. Want more Dark Reading stories in your Google search results? ADD US NOW More Insights Industry Reports The State of Cloud Security: The Latest Challenges How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 Access More Research Webinars Is your AppSec program Mythos Ready? Experts Explain How to Develop a Framework for Cyber-Fraud Fusion Prevention at Machine Speed: Hunting Beyond Known Detections 0-Day to 10x Discovery: Security at the Speed of Mythos When AI Becomes an Insider: Rethinking Risk in Critical Infrastructure More Webinars You May Also Like CYBERATTACKS & DATA BREACHES Russian Hackers Weaponize Microsoft Office Bug in Just 3 Days by Jai Vijayan FEB 03, 2026 CYBERATTACKS & DATA BREACHES Critical Fortinet Flaws Under Active Attack by Jai Vijayan DEC 17, 2025 CYBERATTACKS & DATA BREACHES CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Rob Wright DEC 04, 2025 CYBERATTACKS & DATA BREACHES Deja Vu: Salesforce Customers Hacked Again, Via Gainsight by Nate Nelson NOV 21, 2025 Black Hat USA Coverage APPLICATION SECURITY AI Harnesses Burst With Potential Exploit Opps byRobert Lemos JUL 30, 2026 4 MIN READ CYBERSECURITY OPERATIONS Red Agents vs. Blue Agents: How to Make AI Better at Defense byRob Wright JUL 29, 2026 5 MIN READ APPLICATION SECURITY When AppSec Scanners Become a Supply Chain Attack Vector byEricka Chickowski JUL 29, 2026 5 MIN READ СLOUD SECURITY Ghost Credentials Expose Cloud Systems to Hidden Identity Risks byJeffrey Schwartz JUL 28, 2026 3 MIN READ Want more Dark Reading stories in your Google search results? Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. SUBSCRIBE LOADING... AUG 1-6 | MANDALAY BAY, LAS VEGAS USE CODE: DARKREADING & SAVE $200 ON A BRIEFINGS PASS OR $100 ON A BUSINESS PASS The premier cybersecurity event returns. GET YOUR PASS Discover More Black Hat Omdia Working With Us About Us Meet the Editors Advertise Reprints Join Us NEWSLETTER SIGN-UP Follow Us Copyright © 2026 TechTarget, Inc. d/b/a Informa TechTarget. This website is owned and operated by Informa TechTarget, part of a