Fake Adobe Update

Software updates are so routine that most employees give them little thought. Adobe Reader needs an update, Zoom has a new version, or a system utility asks permission to run. These are ordinary interruptions in the workday, and in most cases the natural response is to approve the update and continue working.

That familiarity is exactly what a recently discovered malware campaign is exploiting.

Researchers at Securonix have been tracking a campaign they call SMOKE#SCREEN that disguises malicious software as Adobe and Zoom updates, system maintenance utilities and business documents. The attackers are not relying solely on obscure applications or obviously suspicious downloads. They are borrowing the names and appearance of software employees already know, then combining them with legitimate technology and trusted Internet services to make malicious activity more difficult to distinguish from normal business activity.

A CONVINCING IMITATION

In one example documented by the researchers, a malicious executable was named AdobeReader_Update.exe. Another appeared to be a system-checking utility. The phishing pages supporting the attack used recognizable logos, brand colors, progress bars and other visual elements intended to create the impression that a legitimate update was underway.

Once an employee runs the file, the attack moves beyond the fake update. The malware can install ConnectWise ScreenConnect, a legitimate remote monitoring and management platform commonly used by IT departments and service providers to remotely access computers. In this campaign, however, ScreenConnect is configured to communicate with infrastructure controlled by the attackers, potentially giving them remote access to the compromised machine.

This is what makes the campaign more significant than another warning about fake Adobe updates. The attackers are deliberately mixing malicious activity with legitimate technology. Researchers observed installers delivered through established services such as Dropbox and Cloudflare, and the ScreenConnect installers themselves can carry a valid digital signature. Newer versions of the campaign have also introduced a delay before certain activity begins, another technique intended to make detection more difficult.

None of those things makes the activity safe. They simply make it look more like the technology already moving through a business every day.

THE RISK DOESN'T END AT THE EMPLOYEE'S DESKTOP

For a manufacturing company, the concern is not merely that one employee might have an infected computer. The more important question is what that computer can reach.

An office workstation may have access to the ERP system, shared production files, customer and supplier information, financial records, email accounts and credentials used elsewhere in the organization. Depending on how the network is configured, an attacker who gains remote access to one machine may have opportunities to move farther into the business.

That changes the way companies should think about software updates. Employee awareness remains important, but it is unreasonable to make employees the final security control when the fraudulent update may carry familiar branding, arrive through trusted infrastructure and ultimately install legitimate remote-access software.

The stronger approach is to control what software can be installed, how updates are distributed and who has permission to install applications. Securonix specifically recommends restricting untrusted installers through application-control technology and monitoring for attempts to disable or modify endpoint security protections. Organizations should also understand which remote-management tools are authorized on their networks and investigate installations or connections that fall outside that standard.

For employees, the guidance can remain straightforward: an unexpected request to download or install software deserves verification, even when the name and logo on the screen are familiar. Legitimate software does not become legitimate simply because a website says it is Adobe, Zoom or another company employees recognize.

A DIFFERENT KIND OF SECURITY PROBLEM

The larger lesson from SMOKE#SCREEN is not that businesses should distrust every software update. It is that appearance has become a much weaker indicator of legitimacy.

Cybercriminals have become increasingly effective at operating inside the ordinary technology of business. Familiar brands provide credibility. Trusted cloud services provide infrastructure. Legitimate administration tools can provide remote access. Individually, each can appear entirely normal.

For business leaders, that puts greater importance on the controls behind the screen: how software enters the company, what employees are permitted to install, which remote-access tools are authorized and whether unusual activity is being monitored.

A convincing fake is much less dangerous when the company does not rely on appearance alone to decide what is allowed to run.

Data-Link Associates is a managed services provider specializing in cybersecurity, IT support and ERP systems for manufacturers, distributors and wholesalers. Our office is located in Sugar Grove, Illinois, and we manage manufacturing IT nationwide. At your service since 1983. Contact Angela Jamerson at ajamerson@datalinkmsp.com or (630) 406-8969.