Key Takeaways
- Attackers are increasingly abusing legitimate Remote Monitoring and Management (RMM) tools such as ConnectWise ScreenConnect to gain stealthy, persistent access.
- The SMOKE#SCREEN campaign uses multi‑layered social‑engineering lures (Adobe/Zoom updates, document reviews) and a toolkit of VBScript droppers, .NET loaders, batch files, and an HTML phishing page hosted on a WsgiDAV server.
- Anti‑analysis checks abort execution if security or virtualization tools (Wireshark, Process Monitor, VirtualBox, etc.) are detected; the campaign then delivers an encrypted PowerShell command that fetches a C# payload.
- Cloudflare Quick Tunnel services are leveraged to create ephemeral, low‑profile C2 channels, making detection harder for traditional reputation‑based filters.
- Successful infections install a ScreenConnect agent that beacons to attacker‑controlled relay servers, granting full remote desktop control.
- A separate threat leverages fake “Xeno Executor” cheats for Roblox and other games to deploy a Java‑based information stealer (Powercat) capable of credential theft, webcam/screen capture, and hands‑on‑keyboard access.
- Powercat performs environment validation via a local image file, downloads an obfuscated JAR, and can inject malicious JavaScript into specific cryptocurrency wallets (e.g., Exodus) to steal tokens.
- Defenders should restrict untrusted MSI execution, monitor tampering with security products, audit legitimate RMM usage, enforce strict UAC settings, and watch for suspicious PowerShell/cmd activity.
- Gaming‑related lures remain effective; educating users about unofficial cheat distributors and blocking unknown Java/JAR executions reduces risk.
Overview of the SMOKE#SCREEN Campaign
Securonix Threat Research has identified an ongoing, multi‑wave intrusion effort dubbed SMOKE#SCREEN that distributes the ConnectWise ScreenConnect remote‑access tool under the guise of benign software updates. The campaign relies on spear‑phishing emails that masquerade as Adobe or Zoom updates, requests to review business documents, or notices about system maintenance utilities. Each lure contains either an obfuscated VBScript dropper or a batch‑script loader that ultimately leads to the installation of a ScreenConnect agent. Unlike custom remote access trojans, the abuse of a legitimate RMM product enables the attackers to blend with authorized IT tooling, reducing the likelihood of triggering conventional endpoint defenses.
Infection Chain and Technical Details of SMOKE#SCREEN
The initial access vector is a phishing email carrying a Visual Basic Script (VBScript) dropper. Upon execution, the dropper first runs a series of environment and anti‑analysis checks. It queries the system for known debugging, monitoring, or virtualization tools—Wireshark, Process Monitor, Oracle VM VirtualBox, Broadcom VMware Tools, Citrix XenServer, and Fiddler Classic. If any of these processes are present, the script aborts to avoid detection in a sandbox or analyst environment. Assuming the checks pass, the dropper decrypts a PowerShell command that contacts the IP address 207.189.11[.]170 to retrieve a compiled .NET executable. This C# payload then performs further staging, eventually downloading and installing the ScreenConnect MSI from the attacker‑controlled WsgiDAV server at 207.174.0[.]143:8080.
Anti‑Analysis and Evasion Tactics
Beyond the basic process‑blacklist, the campaign employs multiple evasion layers. One observed variant delivers a compressed archive containing a batch script that disables Windows Antimalware Scan Interface (AMSI), elevates privileges via a User Account Control (UAC) prompt, disables SmartScreen through registry modifications, and strips the Zone.Identifier alternate data stream from the downloaded MSI before execution. These steps neutralize several built‑in Windows defenses and help the malware evade both signature‑based and behavior‑based detections. The attackers also rotate delivery mechanisms, using trusted hosting services such as Dropbox for early phishing pages (e.g., zoom‑update.html) to bypass domain reputation filters, and leveraging Cloudflare Quick Tunnel for temporary, low‑profile C2 channels.
Use of Cloudflare Tunnels and Staging Server
Securonix analysts noted that the campaign’s staging infrastructure relies on WsgiDAV—a lightweight, HTTP‑based file server—hosting malicious payloads and maintaining command‑and‑control (C2) communication. The WsgiDAV server runs cloudflared.exe, indicating the abuse of Cloudflare’s Quick Tunnel service to expose a local server via a sub‑domain like subscription‑magnetic‑recommended‑meat.trycloudflare.com. Because these tunnels are short‑lived and appear as legitimate Cloudflare traffic, they often evade network‑based reputation and intrusion‑detection systems that focus on static malicious domains.
Persistence via ScreenConnect Relay
All infection paths converge on the installation of the ScreenConnect client. Once deployed, the agent establishes a persistent outbound connection to one of three attacker‑controlled relay servers (identified through embedded configuration strings in the MSI/EXE payloads) on port 8041. This relay provides the threat actor with a reliable remote‑desktop channel, allowing interactive control, file transfer, and additional payload deployment without needing to maintain a custom C2 infrastructure. The use of a legitimate RMM service means traffic often looks like normal IT support activity, further complicating detection.
Defensive Recommendations for SMOKE#SCREEN
Organizations should treat any unsolicited MSI or EXE execution as suspicious, especially when originating from email attachments or unverified links. Enforcing execution policies that block unsigned or untrusted MSI files, monitoring for attempts to disable security products (AMSI, SmartScreen, Windows Defender), and auditing legitimate use of RMM tools can help detect abuse. Additionally, maintaining strict UAC configurations that prevent standard users from bypassing elevation prompts, monitoring for anomalous PowerShell or cmd.exe processes, and employing network‑level inspection of traffic to known Cloudflare tunnel domains will reduce the success rate of this campaign.
Overview of the Fake Xeno Roblox Cheat Campaign
Parallel to the RMM abuse, Bitdefender has disclosed a separate threat targeting gamers via fraudulent “Xeno Executor” cheats for Roblox, Minecraft, and other popular titles. Distributed through gaming forums, Discord communities, and counterfeit download sites, these lures claim to provide unfair advantages such as aimbots or wallhacks. In reality, the archives contain a multi‑stage Java‑based malware chain that ultimately deploys the information stealer dubbed Powercat.
Infection Flow of Powercat Java Stealer
The victim receives a compressed file masquerading as a legitimate Xeno cheat. Inside, an executable named xeno.exe is launched; rather than providing cheat functionality, it serves as the first stage of the malware. This stage checks for a Java Runtime Environment (JRE), downloading and installing one if absent. It then reads a local file, XenoIcon.jpg, which holds cryptographic keys needed to validate communication with the C2 server at solthere[.]net. After validation, the launcher extracts and executes an obfuscated JAR disguised as decompiler.exe. This second stage performs additional environment checks, registers the infected host with the C2, and downloads the final payload—a fully featured Java stealer and surveillance tool.
Capabilities and Data Targeted by Powercat
Powercat combines information theft, espionage, persistence, and remote access. It harvests saved credentials from a wide range of applications, including major web browsers (Brave, Chrome, Edge, Opera, Opera GX, Vivaldi), cryptocurrency wallets (Atomic, Cake Wallet, Exodus, Monero Wallet, SafePal, Tron Wallet), development tools (Git, JetBrains suites, Visual Studio, Python IDLE), game launchers (Battle.net, Epic Games, Riot Client, Rockstar, Steam), VPN clients (ExpressVPN, Mullvad, NordVPN, Surfshark), and messaging apps (Discord, Snapchat, Telegram, WhatsApp). For the Exodus wallet, the stealer specifically checks for version 26.1.5, extracts the app.asar archive, injects malicious JavaScript, and exfiltrates authentication tokens. Beyond credential harvesting, Powercat can capture screenshots, record webcam footage, stream the desktop, log keystrokes and mouse activity, manipulate files, run arbitrary PowerShell commands, and open an interactive shell, giving attackers hands‑on‑keyboard control of the compromised host.
Evasion and Distribution Tactics
The campaign’s success hinges on exploiting users’ desire for competitive advantage in gaming environments. By presenting the malware as a desirable cheat, attackers lower the victim’s guard and encourage voluntary execution of untrusted code. The use of Java enables cross‑platform compatibility, while the staged delivery (checking for JRE, using a benign‑looking image file for key storage, and employing an obfuscated JAR) helps evade heuristic and signature‑based detections. Moreover, the reliance on community platforms such as Discord and gaming forums facilitates rapid spread without raising immediate suspicion.
Recommendations for Gaming‑Related Malware
Users should avoid downloading cheats, mods, or utilities from unofficial sources, and administrators should consider application‑control policies that block the execution of unknown JAR or Java‑based executables from the internet. Endpoint solutions that monitor for anomalous Java processes, unexpected outbound connections to domains like solthere[.]net, and attempts to read or modify sensitive files (e.g., browser credential stores) are essential. Educating gamers about the risks of “free cheats” and encouraging the use of official marketplaces or verified sources can significantly reduce the infection surface.
Conclusion
Both the SMOKE#SCREEN and Fake Xeno Roblox Cheat campaigns illustrate how threat actors continuously adapt their tactics to abuse trusted tools and user interests. The former leverages legitimate RMM software to gain stealthy, persistent remote access, while the latter weaponizes gaming culture to deploy a powerful Java‑based stealer with extensive surveillance capabilities. Effective defense requires a layered approach: restricting execution of untrusted binaries, monitoring for tampering with security controls, auditing the use of legitimate admin and RMM tools, enforcing strict UAC and application‑control policies, and maintaining vigilant user‑awareness training—particularly in environments where gaming or collaborative software is prevalent. By addressing these vectors, organizations can markedly reduce the risk posed by these evolving threats.