How Threat Actors Abuse Remote Management Software for Initial Access