Hackers Exploit Social Security Administration Branding to Deliver ConnectWise RAT

Earlier iterations of this campaign relied on ConnectWise’s infrastructure for command-and-control (C2) operations, but later versions use dynamic DNS services and attacker-hosted domains.