Skip to content
NewA calmer, faster ZeroHour
Threat actormedium

SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access

Security Affairsby @securityaffairs ()4 min read3 · 1 read
Read at securityaffairs.com
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
threat-actor

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainsubscription-magnetic-recommended-meat.trycloudflare.comder (MemoryLoader.cs) references a Cloudflare Quick Tunnel (subscription-magnetic-recommended-meat.trycloudflare.com), a service designed for temporary local server exposure th
ipv4207.174.0.143browsable, exposing 15 payload files. The same IP address (207.174.0[.]143) that hosts the staging server also runs the primary Scre

From the original article

4 min read at securityaffairs.com

SMOKE#SCREEN uses fake Zoom updates to install ScreenConnect RMM, giving attackers persistent remote access while bypassing defenses.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.