WsgiDAV Server Used as Malicious Staging and C2 Infrastructure

The SMOKE#SCREEN campaign used a live WsgiDAV-based server to stage malicious payloads and maintain command-and-control over infected machines via a ScreenConnect relay on port 8041.