The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks.
Smoke#Screen RMM Takeover Gambit Exposes Threat Actor Playbook
Summary + source link. No paywalls, no tracking.