SMOKE#SCREEN: ScreenConnect RMM Abuse via Trusted Software Lures and Cloudflare Tunnels

A multi-wave intrusion campaign was identified delivering ConnectWise ScreenConnect remote monitoring and management (RMM) agents under the guise of routine software updates, document reviews, and system maintenance. What began with the analysis of a single VBScript dropper expanded after investigators discovered a live staging server exposing fifteen payloads, enabling the reconstruction of five distinct execution chains and three ScreenConnect relay clusters. Despite differences in delivery and execution, every chain converges on the same objective: silently installing a ScreenConnect client configured to connect to attacker-controlled infrastructure, providing persistent remote access while blending with legitimate IT administration software.

Initial access depends on user execution and a rotating collection of social-engineering lures and loaders, including obfuscated VBScript droppers, WMI-based scripts, batch files, compiled .NET loaders, and HTML pages impersonating Zoom and Adobe update prompts. Earlier VBScript variants use hex-encoded XOR encryption, control-flow flattening, junk arithmetic that alters byte-level signatures between builds, and sandbox checks that terminate execution on systems with limited memory or known analysis tools. One variant decrypts a PowerShell command that retrieves remote C# source code and compiles it in memory. A later WMI-based variant launches processes through the Win32_Process class with hidden windows, avoiding more conventional script-host execution paths commonly monitored by endpoint security products.

Over time, the operators shifted from passive evasion toward actively degrading endpoint protections. A batch-based loader bypasses the Antimalware Scan Interface (AMSI) through in-memory reflection, weakens SmartScreen through registry modifications, creates Windows Defender exclusions for temporary and payload directories, and removes the Mark-of-the-Web from the downloaded installer before launching it silently. A subsequent compiled C# loader takes a more aggressive approach, excluding the entire system drive from Defender scanning, stopping the WinDefend service, and configuring it to remain disabled after reboot. Regardless of the loader used, the final payload is a ScreenConnect installer carrying a valid ConnectWise digital signature, executed silently from a user-writable directory and removed from disk after installation.

Shared delivery and command-and-control infrastructure links the individual waves. One host operates simultaneously as the WsgiDAV staging server and the primary ScreenConnect relay, while two additional relay clusters, each configured with separate key material, provide compartmentalized alternative access. One cluster listens on port 80, potentially allowing ScreenConnect traffic to traverse environments with restrictive outbound filtering. The operators also rotate payload hashes between sessions and distribute installers through Dropbox shared links and Cloudflare Quick Tunnels, leveraging trusted services as intermediary delivery infrastructure. A macOS package variant connects to the same primary relay used by the Windows installers, indicating cross-platform targeting within the same operation. In a later loader, the operators introduce a deliberate delay between installation and service startup; an accompanying source-code comment explicitly references evading detection by a commercial security product.

Beyond the indicators published in the original reporting, Vega threat research pivoted on the identified infrastructure and surfaced additional related indicators, including further relay and staging IP addresses, Cloudflare Quick Tunnel domains, and payload hashes; these indicators appear in the indicator list below.