Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream

Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream

Attack matches three-year long pattern of ScreenConnect attacks tracked by Sophos MDR as STAC4365.

gallagherseanm

Go to sophos

Posted

April 2, 2025

in

adversary in the middle, featured, MFA, MFA phishing, qilin, RMM, ScreenConnect, Security Operations, sophos, supply chain compromise, Threat Research

by

leeanne

Tags: