Rmm

Rogue ScreenConnect clients: hunt the session, not the filenames

Modified ScreenConnect clients that infect every host they connect to. The durable detection is in the audit log.

9 September 2026 · 6 min · PPD