Kickidler employee monitoring software abused in ransomware attacks

Ransomware affiliates (Qilin and Hunters International) used malvertised, trojanized RVTools to install the SMOKEDHAM backdoor and legitimate Kickidler employee-monitoring software to capture credentials and screen activity, then deployed ransomware that encrypted VMware ESXi VMDK files; the report warns of attackers abusing legitimate RMM/monitoring tools and recommends auditing and restricting remote access software.