Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access 伪造Adobe和Zoom更新安装ScreenConnect以实现持久远程访问

TL;DR

• SMOKE#SCREEN is an active multi-wave campaign using fake Adobe and Zoom update lures to deploy ConnectWise ScreenConnect, a legitimate RMM tool repurposed for persistent remote access by threat actors
• The campaign employs a sophisticated toolkit including VBScript droppers, batch file loaders, compiled .NET executables, and HTML phishing pages, with delivery rotating across trusted platforms like Dropbox and Cloudflare Quick Tunnels
• Attackers demonstrate an observable tradecraft evolution from cautious XOR-encrypted droppers to aggressive Defender destruction sequences and back to stealth with anti-EDR timing and self-contained encrypted bundles
• A separate campaign targets gamers through fake Xeno Executor installers, delivering Powercat—a Java-based information stealer capable of credential theft, surveillance, remote access, and interactive system control
• Both campaigns highlight the growing trend of abusing legitimate software (RMM tools, gaming utilities) to bypass security controls and blend in with authorized enterprise tooling

Why It Matters

This article is critically relevant to AI practitioners and security professionals because it demonstrates how threat actors are increasingly weaponizing legitimate tools and trusted platforms to evade detection, a pattern that will likely intensify as AI-powered security solutions become more prevalent. The tradecraft evolution described—particularly the real-time arms race between attackers and defenders—underscores the need for adaptive, behavior-based detection strategies rather than signature-only approaches.

Technical Details

• SMOKE#SCREEN Campaign Architecture: The campaign uses a WsgiDAV-based staging server at 207.174.0.143:8080 for payload staging and C2 communication via ScreenConnect relay on port 8041, with three distinct C2 clusters associated with software update, document review, and document viewer decoy binaries
• VBScript Dropper Mechanism: Initial access via spear-phishing delivers an obfuscated VBScript that performs environment checks, aborting execution if security/analysis tools are detected (Wireshark, Process Monitor, VirtualBox, VMware Tools, Citrix XenServer, Fiddler Classic), then decrypts a PowerShell command to fetch and execute a C# payload
• Defense Evasion Techniques: A third sample uses a batch script to disable AMSI, escalate privileges via UAC prompt manipulation, disable SmartScreen through registry modifications, and remove Zone.Identifier alternate data streams from downloaded MSI files before execution
• Delivery Infrastructure Rotation: Attackers leverage trusted hosting services including Dropbox shared links (bypassing domain reputation filters) and Cloudflare Quick Tunnels via cloudflared.exe for ephemeral C2 channels that are rarely monitored
• Powercat Stealer Capabilities: The Java-based infection chain drops a multifunctional stealer combining credential theft (browser cookies, Discord, Roblox, Minecraft accounts, cryptocurrency wallets), keystroke recording, webcam access, desktop streaming, file manipulation, PowerShell execution, and interactive remote control

Industry Insight

• Organizations should immediately audit their RMM tool usage policies and implement strict execution restrictions for untrusted MSI files, as the abuse of legitimate remote access tools like ScreenConnect represents a growing attack vector that bypasses traditional threat detection
• Security teams should monitor for the specific anti-analysis techniques described—particularly process enumeration checks and the nine-step Defender destruction sequences—as indicators of compromise, and enforce strict UAC settings to prevent privilege escalation
• The rapid evolution of attacker tradecraft from aggressive to stealthy approaches indicates a sophisticated, adaptive threat landscape; defenders should invest in behavior-based detection and continuous monitoring of PowerShell, cmd.exe, and legitimate tool usage patterns rather than relying solely on signature-based defenses

TL;DR

• Securonix发现名为SMOKE#SCREEN的多波次网络攻击活动，通过伪造Adobe/Zoom更新等社会工程学诱饵部署ConnectWise ScreenConnect实现持久化远程访问
• 攻击者滥用合法RMM工具绕过安全控制，利用其在企业环境中的普遍性伪装成授权IT工具，无需部署专用远程访问木马
• 攻击链包含VBScript dropper、PowerShell命令、.NET可执行文件和HTML钓鱼页面，通过WsgiDAV暂存服务器和Cloudflare Quick Tunnel维持C2通信
• 另一独立活动通过虚假Xeno Executor游戏作弊工具分发Powercat信息窃取器，窃取凭证、浏览器Cookie、游戏账户和加密货币钱包数据
• 攻击者战术持续演进呈现攻防实时军备竞赛特征，从XOR加密dropper到九步Defender破坏序列再到反EDR定时策略

为什么值得看

这篇文章揭示了当前网络攻击的两个重要趋势：合法RMM工具的滥用和针对游戏社区的恶意软件分发，对安全从业者和企业IT管理者具有重要警示意义。攻击者不断调整战术策略，展示了现代网络威胁的复杂性和适应性。

技术解析

SMOKE#SCREEN活动采用多层攻击链：初始通过钓鱼邮件投递混淆的VBScript dropper，执行环境和反分析检查（检测Wireshark、Process Monitor、VirtualBox、VMware、Citrix、Fiddler等工具），通过XOR解密获取PowerShell命令，从207.189.11[.]170获取C#有效载荷，最终安装ScreenConnect并连接到三个C2集群之一。

攻击者使用WsgiDAV服务器（207.174.0[.]143:8080）作为暂存服务器和C2中继，通过Cloudflare Quick Tunnel（cloudflared.exe）生成临时隧道，利用Dropbox等可信托管服务绕过域名信誉过滤， phishing页面（zoom-update.html）通过Dropbox共享链接分发载荷。

第三阶段样本通过批处理脚本执行九步Defender破坏序列：禁用AMSI、通过UAC提权、修改注册表关闭SmartScreen、移除Zone.Identifier备用数据流，然后运行MSI安装程序。所有攻击路径最终都导向ScreenConnect客户端安装，允许攻击者建立远程桌面会话。

Powercat信息窃取器通过虚假Xeno Executor安装程序分发，采用多阶段Java感染链，具备凭证窃取、浏览器Cookie窃取、Discord/Roblox/Minecraft账户窃取、加密货币钱包窃取、键盘记录、网络摄像头访问、桌面流式传输、文件操作和PowerShell命令执行能力。

行业启示

合法RMM工具滥用成为新兴威胁模式：攻击者利用ScreenConnect等企业管理工具的合法性和普遍性绕过安全控制，企业需要加强对RMM工具使用的审计和监控，限制未信任MSI文件执行，监控进程篡改安全产品的行为。

游戏社区成为恶意软件分发新渠道：针对Roblox等游戏玩家的虚假作弊工具分发活动表明，攻击者正在拓展传统企业攻击之外的新目标群体，需要加强对游戏社区的安全意识教育，警惕非官方渠道下载的软件。

攻击者战术持续演进呈现攻防军备竞赛特征：从谨慎的加密dropper到激进的Defender破坏再到反EDR定时，攻击者不断调整策略，安全团队需要建立持续监控机制，严格执行UAC设置，防止标准用户绕过提权提示。