SMOKE#SCREEN Abuses ScreenConnect and Cloudflare Tunnels

Summary

The SMOKE#SCREEN campaign involves threat actors deploying legitimate ScreenConnect RMM agents through convincing social engineering lures disguised as Zoom and Adobe updates. The attackers rely on a rotating toolkit of VBScript droppers, .NET loaders, and batch files to bypass security controls and maintain persistent remote access. The campaign reflects evolving tradecraft, shifting from aggressive security software disruption toward stealthier techniques timed to evade EDR detection.

Investigation

Securonix Threat Research uncovered a multi-wave campaign that used WsgiDAV staging servers and Cloudflare tunnels to deliver payloads. Investigators identified three distinct ScreenConnect relay clusters and reconstructed five separate kill chains by analyzing multiple scripts and executable samples. The research also showed a progression from heavily obfuscated VBScript to advanced compiled loaders designed to operate outside specific EDR detection windows.

Mitigation

Defenders should restrict untrusted MSI package execution through AppLocker or WDAC and monitor for unauthorized tampering with security products. Auditing legitimate RMM tool usage and enforcing strict UAC policies are essential for preventing unauthorized remote access. Behavioral EDR rules should also be deployed to identify suspicious parent-child process relationships and unusual installer activity.

Response

If SMOKE#SCREEN activity is detected, affected systems should be isolated immediately to terminate active ScreenConnect sessions. Responders should investigate the original access vector, including phishing emails and malicious software downloads. Any exposed credentials should be revoked, while system configuration changes, particularly Microsoft Defender exclusions and registry modifications, should be reviewed and reversed.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access and seeks to deploy ScreenConnect for persistent remote access. To avoid user interruption and detection, the attacker uses msiexec.exe with the /qn (quiet, no UI) flag to install a malicious MSI package. Once the installation is initiated, the attacker attempts to neutralize the host’s primary defense by using PowerShell to add a Windows Defender exclusion for their tool directory and then attempts to stop the Windows Defender service entirely to prevent real-time scanning of their subsequent toolkit.

• Regression Test Script:

  # Simulation Script: ScreenConnect Silent Install & Defense Evasion
  
  # 1. Create a dummy MSI file for simulation purposes (simulating the ScreenConnect installer)
  # In a real test, a valid MSI would be used.
  $msiPath = "$env:TEMPScreenConnect_Sim.msi"
  Write-Host "[+] Creating dummy MSI at $msiPath"
  # Note: This is a placeholder logic. For true telemetry, a real MSI must be present.
  
  # 2. Execute Silent MSI Installation (Trigger: selection_processname_msi)
  Write-Host "[+] Executing silent MSI installation..."
  Start-Process msiexec.exe -ArgumentList "/i $msiPath /qn" -Wait
  
  # 3. PowerShell Defense Evasion - Add Exclusion (Trigger: selection_powershell_exclusion)
  Write-Host "[+] Attempting to add Defender exclusion via PowerShell..."
  powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:Program FilesScreenConnect'"
  
  # 4. PowerShell Defense Evasion - Stop Defender Service (Trigger: selection_stop_defender)
  Write-Host "[+] Attempting to stop Windows Defender service..."
  powershell.exe -Command "Stop-Service -Name WinDefend"

• Cleanup Commands:

  # Cleanup Simulation Artifacts
  Remove-Item -Path "$env:TEMPScreenConnect_Sim.msi" -ErrorAction SilentlyContinue
  # Note: Reversing Defender changes requires administrative privileges and may impact security posture.
  # Only perform if in a strictly isolated lab environment.
  Write-Host "[!] Cleanup complete. Manual restoration of Defender settings recommended."