I ran a deep scan on the PC in question, and it found nothing bad. The PC itself contains no critical files that are needed, but is used for processing credit cards. VPN is via Meraki, and I have the IDS and IPS cranked up, but I don't think these do much when the threat is inside the network. It is on a network that has VPN access back to the company file servers. It was running TrendMicro Worry Free, and was not actually part of the domain. I'm just going with the assumption that a decent scammer can get around basic Windows password security without much effort. The user account that was logged in has extremely limited access to anything, and can't install/change anything without admin password approval. (Randomly wondering why scammers don't have screen blanking ability). The scammer asked the user to turn off their monitor for 10 minutes while they worked on 'an issue'. Someone in the company took a call from a scammer claiming to be tech support, and allowed them remote access to a PC on the network.

I received the phone call this morning that, while not unexpected at some point in my life, was one I hoped to never get.

How to use anydesk to stop scammers