CVE-2022-36537

The adversary used ConnectWise R1Soft Server Backup Manager software as an initial point of access and as a platform to control downstream systems connected via the R1Soft Backup Agent. This threat is still under active research.

https://blog.fox-it.com/2023/02/22/from-backup-to-backdoor-exploitation-of-cve-2022-36537-in-r1soft-server-backup-manager/