REvil: the usage of legitimate remote admin tooling

In an incident response engagement involving Sodinokibi (also known as REvil) ransomware, an adversary employed a ScreenConnect service as a backdoor on various systems, allowing direct access without requiring Remote Desktop Protocol (RDP) or authentication. This tactic, used by threat actors such as Static Kitten and Zeppelin, proves to be an efficient and effective means of gaining unauthorized access to a targeted system.