From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager

During a recent incident response case, we found traces of an adversary leveraging ConnectWise R1Soft Server Backup Manager software (hereinafter: R1Soft server software). The adversary used it as an initial point of access and as a platform to control downstream systems connected via the R1Soft Backup Agent. This agent is installed on systems to support … Continue reading From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager →