The Connect:fun campaign is particularly notable for its use of ScreenConnect and Powerfun as post-exploitation tools, marking it as Vedere Labs’ first-ever named campaign. The incident that brought this campaign to light involved a media company whose FortiClient EMS was vulnerable and exposed to the internet.

Source: GBHackers