Approval of an AnyDesk connection authorization request sent by Mad Liberator to one organization prompted the execution of a Windows update screen-emulating binary to obtain device control and access to a linked OneDrive account, as well as centralized server files, according to a report from Sophos X-Ops. Mad Liberator then proceeded to exfiltrate files via the AnyDesk FileTransfer facility before using the Advanced IP Scanner to scan for other devices that could be breached and running a ransom note, with the nearly four-hour intrusion ending with the restoration of device control to the victim, said Sophos X-Ops researchers.

Source: SC Magazine