How attackers use real IT tools to take over your computer

A new wave of attacks is exploiting legitimate Remote Monitoring and Management tools such as LogMeIn Resolve (formerly GoToResolve) and PDQ Connect to remotely control victims’ systems. Rather than dropping traditional malware, attackers trick people into installing these trusted IT support programs under false pretenses, disguising them as everyday utilities. Once installed, the tool provides attackers full remote access, evading many security detections because the software itself is legitimate.

Malwarebytes notes an uptick in detection of the riskware label RiskWare.MisusedLegit[.]GoToResolve, reflecting suspicious use of the legitimate GoToResolve/LogMeIn Resolve RMM tool with several different filenames observed in telemetry. The attackers’ use of a pre-configured installer with a hardcoded CompanyId links the victim machine directly to the attacker’s control panel, allowing them to spot and connect to infected systems without extra credentials or bespoke malware.

Firewalls and other security tools often allow RMM traffic, since these tools are designed to run with admin privileges, enabling malicious access to blend in with normal IT admin activity.