Securonix Threat Research has been tracking an active, multi-wave campaign the company is calling SMOKE#SCREEN that’s come to the Mac.
In the campaign, threat actors use a rotating collection of social engineering lures themed around Zoom software updates, business document reviews, and system maintenance utilities to deliver silent ScreenConnect Remote Monitoring and Management (RMM) agent installations.
Here’s some (very technical info) from Securonix Threat Research: The campaign relies on a toolkit of VBScript droppers, batch file loaders, compiled .NET executables and a HTML phishing page, all ultimately pointing to a live WsgiDAV-based staging server at 207.174.0.143:8080. Victims who execute any of the initial access files end up with a fully functional ScreenConnect agent silently installed and beaconing to one of three attacker-controlled relay servers, providing the threat actor with persistent, legitimate-looking remote access to compromised hosts.
The attack paths documented by Securonix required a victim to open a file presented as an update, document or maintenance utility. Software such as Zoom and Adobe Reader should be updated through built-in tools or installers downloaded directly from the developer.
Also, Mac users should be leery of unexpected installer packages. Previous campaigns have shown that signed or even notarized apps can still begin a malicious installation.
I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and sponsored posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.
Article provided with permission from AppleWorld.Today
