Approval of an AnyDesk connection authorization request sent by Mad Liberator to one organization prompted the execution of a Windows update screen-emulating binary to obtain device control and access to a linked OneDrive account.
Article Link: Newly emergent Mad Liberator ransomware gang detailed | SC Media