--- title: Smoke#Screen RMM Takeover Gambit Exposes Threat Actor... description: Securonix researchers have uncovered the Smoke#Screen campaign, in which attackers abuse the legitimate ScreenConnect RMM tool to gain persistent remote access... canonical: https://daily.dev/posts/smoke-screen-rmm-takeover-gambit-exposes-threat-actor-playbook-0ykhqdbl4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook | daily.dev og:description: Securonix researchers have uncovered the Smoke#Screen campaign, in which attackers abuse the legitimate ScreenConnect RMM tool to gain persistent remote access... og:url: https://daily.dev/posts/smoke-screen-rmm-takeover-gambit-exposes-threat-actor-playbook-0ykhqdbl4 og:image: https://api.daily.dev/og/posts/0yKHQDBL4.png og:image:alt: Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Securonix researchers have uncovered the Smoke#Screen campaign, in which attackers abuse the legitimate ScreenConnect RMM tool to gain persistent remote access to compromised Windows and macOS systems. The campaign stands out for rotating payloads between individual download sessions and using four psychologically distinct social engineering lures — fake Zoom/Adobe updates, document-review requests, and a SystemCheck maintenance tool — to maximize victim reach. Attackers inadvertently exposed their C# source code on an open directory, allowing researchers to reconstruct five kill chains and three relay servers. The threat actor layers Cloudflare tunnels, Dropbox, and ConnectWise-signed binaries to evade signature-based controls. Defenders are advised to implement behavioral EDR rules, set UAC to 'Always notify,' and monitor for unauthorized RMM installations and anomalous process relationships. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Smoke#Screen campaign and how does it abuse ScreenConnect? Smoke#Screen is a social engineering campaign identified by Securonix that tricks victims into installing a legitimate ScreenConnect remote monitoring agent, which then beacons to one of three attacker-controlled relay servers. Attackers use lures like fake Zoom and Adobe updates, document requests, and a fake SystemCheck maintenance tool, delivered through rotating VBScript droppers, batch loaders, and .NET executables. _Security teams tracking RMM abuse tactics like this can follow ongoing threat research on daily.dev._ ### Why is detecting RMM tool abuse like ScreenConnect so difficult for security teams? Detection is difficult because the payload is not malware but a properly signed ConnectWise service performing its intended function, including full interactive desktop control and a credential provider DLL. There is no C2 protocol to signature, no unsigned binary, and nothing unusual in the process tree, making signature and reputation-based controls insufficient; behavioral detection is required instead. _Defenders evaluating detection strategies for legitimate-tool abuse can track similar analyses on daily.dev._ ### How did researchers uncover the full scope of the Smoke#Screen attack infrastructure? Securonix began with a single submitted VBScript dropper named zoom-update.vbs and traced it to an active staging server hosting 15 unique payloads. The attackers left their C# source code in an open directory next to compiled builds, letting researchers reconstruct five distinct kill chains and identify three separate ScreenConnect relay servers by observing version changes and infrastructure choices like Dropbox and Cloudflare Quick Tunnels. _Incident responders piecing together attacker infrastructure can find similar threat writeups on daily.dev._ ## Similar posts on daily.dev - [RMM Abuse Explodes as Hackers Ditch Malware](https://daily.dev/posts/rmm-abuse-explodes-as-hackers-ditch-malware-v44l6tyt4) · Dark Reading · 0 upvotes · 0 comments - [How a single ScreenConnect incident exposed a massive campaign](https://daily.dev/posts/how-a-single-screenconnect-incident-exposed-a-massive-campaign-hxzs54kdz) · Securelist · 0 upvotes · 0 comments - [RMM Tools Fuel Stealthy Phishing Campaign](https://daily.dev/posts/rmm-tools-fuel-stealthy-phishing-campaign-2snls3mpu) · Dark Reading · 0 upvotes · 0 comments - [RMM Abuse: How Attackers Exploit Remote Access Tools](https://daily.dev/posts/rmm-abuse-how-attackers-exploit-remote-access-tools-kmwmtlqwz) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/smoke-screen-rmm-takeover-gambit-exposes-threat-actor-playbook-0ykhqdbl4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook","url":"https://daily.dev/posts/smoke-screen-rmm-takeover-gambit-exposes-threat-actor-playbook-0ykhqdbl4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/smoke-screen-rmm-takeover-gambit-exposes-threat-actor-playbook-0ykhqdbl4"},"datePublished":"2026-08-04T18:49:21.263Z","dateModified":"2026-09-14T06:39:49.124Z","description":"Securonix researchers have uncovered the Smoke#Screen campaign, in which attackers abuse the legitimate ScreenConnect RMM tool to gain persistent remote access...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f53f6d494538d22b4cd7a4391e7f8433?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f53f6d494538d22b4cd7a4391e7f8433?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/smoke-screen-rmm-takeover-gambit-exposes-threat-actor-playbook-0ykhqdbl4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,phishing","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/smoke-screen-rmm-takeover-gambit-exposes-threat-actor-playbook-0ykhqdbl4#faq","mainEntity":[{"@type":"Question","name":"What is the Smoke#Screen campaign and how does it abuse ScreenConnect?","acceptedAnswer":{"@type":"Answer","text":"Smoke#Screen is a social engineering campaign identified by Securonix that tricks victims into installing a legitimate ScreenConnect remote monitoring agent, which then beacons to one of three attacker-controlled relay servers. Attackers use lures like fake Zoom and Adobe updates, document requests, and a fake SystemCheck maintenance tool, delivered through rotating VBScript droppers, batch loaders, and .NET executables. Security teams tracking RMM abuse tactics like this can follow ongoing threat research on daily.dev."}},{"@type":"Question","name":"Why is detecting RMM tool abuse like ScreenConnect so difficult for security teams?","acceptedAnswer":{"@type":"Answer","text":"Detection is difficult because the payload is not malware but a properly signed ConnectWise service performing its intended function, including full interactive desktop control and a credential provider DLL. There is no C2 protocol to signature, no unsigned binary, and nothing unusual in the process tree, making signature and reputation-based controls insufficient; behavioral detection is required instead. Defenders evaluating detection strategies for legitimate-tool abuse can track similar analyses on daily.dev."}},{"@type":"Question","name":"How did researchers uncover the full scope of the Smoke#Screen attack infrastructure?","acceptedAnswer":{"@type":"Answer","text":"Securonix began with a single submitted VBScript dropper named zoom-update.vbs and traced it to an active staging server hosting 15 unique payloads. The attackers left their C# source code in an open directory next to compiled builds, letting researchers reconstruct five distinct kill chains and identify three separate ScreenConnect relay servers by observing version changes and infrastructure choices like Dropbox and Cloudflare Quick Tunnels. Incident responders piecing together attacker infrastructure can find similar threat writeups on daily.dev."}}]} ```