MEDIUM Threat Intel
Smoke#Screen RMM Takeover Campaign Targets Enterprise Networks
Discover how the Smoke#Screen phishing campaign uses rotating payloads and ScreenConnect to achieve persistent remote network access.
- Adversersaries are executing social engineering lures paired with remote monitoring tools to establish unauthorized persistence inside enterprise networks.
- The campaign utilizes rotating payloads and legitimate remote management software to evade standard signature-based detection mechanisms.
- Defenders must audit remote monitoring and management tool installations across all endpoints to detect unauthorized instances.
Runtime Rebel Intel
2 min read · Aug 5, 2026