Fake Software Updates

SMOKE#SCREEN Campaign Uses Legitimate ScreenConnect Installs to Give Attackers Persistent Access

Securonix researchers say operators reconfigure vendor-signed ScreenConnect clients to call attacker-run relay servers so intrusions look like normal IT activity.