ScreenConnect: Legitimate RMM Tool Abused for Persistent Remote Access

ScreenConnect, a remote monitoring and management (RMM) tool by ConnectWise, is being abused by threat actors in the SMOKE#SCREEN campaign to gain persistent remote access to compromised systems. The attackers install the ScreenConnect agent, which beacons to attacker-controlled relay servers, allowing them to open remote desktop sessions and maintain control over victim machines.