tag: Remote-Access-Trojan · 1 items
- Engineer — Skip
- SOC/IR — Act: A phishing campaign is actively distributing ScreenConnect as a RAT using COLDCARD vulnerability lures; hunt for unexpected ScreenConnect installations on endpoints and tune EDR detections for ScreenConnect deployed outside approved baselines.
- Leader — Learn: This campaign illustrates how high-profile crypto incidents are rapidly weaponized as phishing lures; useful context for security awareness briefings but no immediate organizational action required.