NEW RMM TRADECRAFT: In the last few weeks Huntress has observed a notable pattern across multiple customer environments: rogue ScreenConnect clients repeatedly spawning the Windows Script Host to execute a series of four Visual Basic Script files. https://www.huntress.com/blog/rogue-screenconnect-installations