SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access
Overview
A new campaign known as SMOKE#SCREEN has been identified by Securonix Threat Research, where attackers are using deceptive tactics to gain unauthorized remote access to systems. The attackers are distributing fake Zoom updates and other social engineering lures to install ScreenConnect, a remote management tool, on victims' devices. This allows them to maintain persistent access while evading security measures. The campaign is ongoing and utilizes various methods, including notices about Adobe software and system maintenance prompts, making it particularly insidious. Organizations and individuals should be vigilant about such fraudulent updates and take necessary precautions to protect their systems.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: ScreenConnect RMM, Zoom, Adobe software
- Action Required: Users should avoid downloading software updates from unverified sources and ensure their security solutions are up to date.
- Timeline: Ongoing since recent months
Original Article Summary
SMOKE#SCREEN uses fake Zoom updates to install ScreenConnect RMM, giving attackers persistent remote access while bypassing defenses. Securonix Threat Research has been tracking an active multi-wave campaign they’ve named SMOKE#SCREEN, in which unknown attackers use rotating social engineering lures, fake Zoom updates, Adobe software notices, business document reviews, system maintenance utilities, to silently install ConnectWise […]
Impact
ScreenConnect RMM, Zoom, Adobe software
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since recent months
Remediation
Users should avoid downloading software updates from unverified sources and ensure their security solutions are up to date. Regular system scans and monitoring for unauthorized access can help mitigate risks.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Malware, Adobe.