KMS Auto was abused as the entry point in a multi-stage intrusion that led to XMRig mining, remote access via ScreenConnect and MeshAgent, and a scareware payload posing as ransomware. #KMSAuto #XMRig #APT36