Hackers Using RMM Tools LogMeIn and PDQ Connect to Deploy Malware as Legitimate Software

Cybersecurity researchers at AhnLab Security Intelligence Center (ASEC) have uncovered a campaign that weaponises legitimate remote monitoring and management tools to deploy backdoor malware on users’ systems. The attackers abuse LogMeIn Resolve (GoTo Resolve) and PDQ Connect, using them to run PowerShell commands and install PatoRAT, a Delphi‑developed backdoor with extensive data exfiltration and remote control capabilities.

Victims are lured via convincing fake download portals that mimic official pages for popular utilities, with malicious installers distributed under disguising filenames such as “notepad++.exe,” “7-zip.exe,” “winrar.exe,” “chatgpt.exe,” “OpenAI.exe,” and “windows12_installer.exe.” The CompanyId field in LogMeIn Resolve’s configuration—values 8347338797131280000, 1995653637248070000, and 4586548334491120000—helps threat actors gain control through LogMeIn’s infrastructure.

The campaign also contains Portuguese language strings within PatoRAT, suggesting possible Brazilian origins, and the malware can perform tasks such as keylogging, screen capture, browser credential theft, and HVNC‑based remote desktop access. Discerning analysts should monitor for these CompanyId values and PatoRAT indicators of compromise, and organisations should verify software signatures and maintain updated security tooling.