Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook

Summary

A threat actor, dubbed Smoke#Screen, is actively targeting Remote Monitoring and Management (RMM) tools. The group employs sophisticated social engineering tactics, using diverse lures to trick victims into executing payloads. These payloads deliver ScreenConnect, a legitimate remote access tool, which the attackers then leverage to gain persistent access to compromised networks, likely for further malicious activities.

Indicators of Compromise

• malware — ScreenConnect

Entities