# Smoke#Screen Campaign Weaponizes RMM Tools

> The Smoke#Screen campaign leverages legitimate RMM tools to take over victim systems through phishing, exposing a complete threat actor playbook.

**URL:** https://www.ciptadusa.com/blog/smoke-screen-rmm-phishing-takeover-20260805  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Application Security  
**Published:** 2026-08-05  
**Cover:** https://cdn-uagents.enitip.com/uploads/blog/2026-08/daily-appsec-20260805-014625.jpg  

## Article

A new phishing campaign dubbed **Smoke#Screen** weaponizes Remote Monitoring and Management (RMM) tools as its primary attack vector—not custom malware, but legitimate software already trusted by IT teams worldwide.

## Summary

The Smoke#Screen campaign leverages legitimate RMM tools to take over victim systems through phishing, exposing a complete threat actor playbook that prioritizes stealth through tool legitimacy over technical sophistication.

## The Challenge

Remote Monitoring and Management tools like AnyDesk, ConnectWise, and TeamViewer are designed to help IT teams manage endpoints remotely. The problem: those same tools grant identical access to threat actors who successfully install them on victim machines.

This approach is gaining popularity for three reasons. First, **RMM traffic is not flagged as malicious** by most security stacks—the tools are legitimate, signed, and well-known to EDR solutions. Second, **no need to develop custom RATs** that are expensive to build and easy to detect. Third, **built-in persistence**—RMM tools typically auto-start and survive reboots without registry manipulation.

Smoke#Screen adds a sophisticated social engineering layer: phishing emails disguised as invoices or helpdesk notifications direct victims to pages that download RMM installers preconfigured to connect to the attacker's command server.

## Approach

What makes Smoke#Screen different from previous RMM abuse campaigns?

**Dark Reading** reports that the threat actors behind this campaign documented their entire playbook—from initial phishing lure through post-exploitation lateral movement—with precision indicating an organized operation, not script kiddies.

Effective detection requires a layered approach: monitor for unauthorized RMM tool installations, audit outbound connections from RMM processes to non-organizational servers, and implement application allowlisting that permits only RMM tools from officially sanctioned vendors.

For teams already using RMM legitimately, the key differentiator is **connection destination**—legitimate RMM agents only contact official vendor relay servers, while attacker-planted agents connect to C2 infrastructure outside that list.

## References

- [Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook - Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/latest-rmm-fueled-phishing-attack-exposes-threat-actor-playbook)
- [CISA Advisory: Protecting Against Malicious Use of Remote Monitoring and Management Software](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a)
- [MITRE ATT&CK T1219 - Remote Access Software](https://attack.mitre.org/techniques/T1219/)

---

*Markdown version of https://www.ciptadusa.com/blog/smoke-screen-rmm-phishing-takeover-20260805 — generated for AI agents and LLM crawlers.*