Delphi PatoRAT Backdoor Hijacks LogMeIn Resolve and PDQ Connect RMM Tools for Full System Takeover

Researchers from the AhnLab Security Intelligence Center (ASEC) have disclosed a new campaign that exploits remote monitoring and management tools—LogMeIn Resolve (GoTo Resolve) and PDQ Connect—to deploy a Delphi-based backdoor named PatoRAT, enabling full system takeover. The attackers disguise the malware as legitimate software downloads, tricking users into installing remote management tools preconfigured to connect to attacker-controlled infrastructure, according to ASEC.

Once installed, the tools allow threat actors to execute PowerShell commands remotely and deploy PatoRAT, which provides remote control and information theft capabilities; internal strings in the Delphi codebase include Portuguese, with configuration data such as clientTag, mutex name, and a list of C&C servers encrypted by XOR.

The LogMeIn installers were distributed under fake filenames mimicking popular utilities like notepad++.exe, 7-zip.exe, winrar.exe, Microsoft.exe, and chatgpt.exe, and in Korea campaigns, three different CompanyId values were used to seize control. ASEC has not attributed the campaign to a specific threat group, but the Delphi-based payload and Portuguese strings suggest a possible link to Brazilian or Latin American cybercrime groups.