{"id":2202,"date":"2026-08-04T16:03:19","date_gmt":"2026-08-04T16:03:19","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2202"},"modified":"2026-08-04T16:03:19","modified_gmt":"2026-08-04T16:03:19","slug":"fake-adobe-and-zoom-updates-install-screenconnect-for-persistent-remote-access","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2202","title":{"rendered":"Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access"},"content":{"rendered":"
\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Remote Monitoring and Management (RMM) programs like ConnectWise ScreenConnect.<\/p>\n

The campaign has been codenamed SMOKE#SCREEN<\/b> by Securonix Threat Research.<\/p>\n

\u00abThe campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and an HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0[.]143:8080,\u00bb researchers Shikha Sangwan, Akshay Gaikwad, and Aaron Beardslee said in a report<\/a> shared with The Hacker News.<\/p>\n

Successful attacks culminate with a ScreenConnect agent installed and beaconing to one of three attacker-controlled relay servers, providing the attackers with persistent remote access to compromised systems. The activity has not been attributed to any known threat actor or group.<\/p>\n

The findings add to the growing abuse of legitimate RMM tools by threat actors, as it allows them to bypass security controls and take advantage of their prevalence in enterprise environments to blend in with authorized IT tooling without the need for deploying a purpose-built remote access trojan.<\/p>\n

Securonix said its investigation commenced following the discovery of a live WsgiDAV server that served two purposes: stage malicious payloads and maintain command-and-control (C2) over existing infected machines through a ScreenConnect relay on port 8041.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

An analysis of the ScreenConnect relay configuration strings embedded in the MSI and EXE payloads has uncovered three distinct C2 clusters, each associated with software update, document review, and document viewer decoy binaries.<\/p>\n

The initial access vector is assessed to be spear-phishing, with the emails serving as a conduit for an obfuscated Visual Basic Script (aka VBScript) dropper that first performs a series of environment and anti-analysis checks to ensure safe execution. It also enumerates running processes, and aborts if any of the following executables are running –<\/p>\n