A threat actor has shifted tactics by installing multiple remote management and monitoring (RMM) tools — notably ScreenConnect, LogMeIn Resolve, and Naverisk — on compromised machines, often installing additional RMMs long after initial compromise to maintain persistence and harvest credentials. Phishing emails with lures like holiday invites and fake invoices deliver signed MSI/EXE installers that deploy RMMs and utility tools such as HideMouse and WebBrowserPassView. #ScreenConnect #LogMeInResolve #Naverisk
Keypoints
- The campaign uses phishing emails (holiday party invites, invoices, tax notices, Zoom invites, documents to sign) to deliver malicious URLs pointing to MSI/EXE installers.
- Initial compromise commonly installs ScreenConnect, which is then used to deploy a secondary attacker toolset for credential harvesting and defense disabling.
- Attackers have evolved to install multiple RMM tools over time — SimpleHelp, PDQ, Atera, and most recently LogMeIn Resolve and Naverisk alongside ScreenConnect.
- RMM installations are often chained (one RMM used to install another) and can occur days or weeks after the first compromise, increasing dwell time and redundancy.
- Common secondary tools include HideMouse.exe, WebBrowserPassView, and Defender Control, indicating goals of stealth, credential theft, and security disabling.
- Motivations are uncertain but likely include selling persistent access to other threat actors (e.g., for ransomware) or avoiding detection/expiry of trial licenses.
- Symantec provides detection for known IOC files and encourages consulting its Protection Bulletin for mitigation guidance.
MITRE Techniques
- [T1566] Phishing – The campaign begins with phishing emails using lures such as “Party Invitation” or “December Holiday Party” to deliver malicious URLs (“The emails contain malicious URLs linking to setup executables or MSI installers.”).
- [T1204] User Execution – Malicious MSI/EXE installers are delivered and executed by victims (“The emails contain malicious URLs linking to setup executables or MSI installers.”).
- [T1071] Application Layer Protocol – Attackers use legitimate remote access RMM applications (ScreenConnect, LogMeIn Resolve, Naverisk) to communicate and move laterally (“ScreenConnect would then be used to download an additional attacker toolset.” ).
- [T1574] Hijack Execution Flow (Signed Installer Abuse) – Signed installers are used to deliver RMM installers and secondary tools, abusing legitimate installation flows (“The emails contain malicious URLs linking to setup executables or MSI installers. In some cases the installers are signed.”).
- [T1536] Credentials from Web Browsers – Tools like WebBrowserPassView are used to harvest stored browser credentials (“WebBrowserPassView: A password-recovery tool that reveals the passwords stored by multiple web browsers.”).
- [T1562] Impair Defenses – Tools such as Defender Control are deployed to disable Windows Defender (“Defender Control: A tool for disabling Windows Defender.”).
- [T1105] Ingress Tool Transfer – Secondary tools (HideMouse, WebBrowserPassView, Defender Control, others) are downloaded and installed post-compromise via RMM channels (“ScreenConnect would then be used to download an additional attacker toolset.”).
- [T1090] Proxy/Redundancy via Multiple RMMs – Installing multiple RMM tools over time to maintain access and redundancy (“They are now infecting its victims with multiple RMM tools… often a period of time can elapse between installations.”).
Indicators of Compromise
- [File Hash] Known malicious installers and tools – ScreenConnect MSI: 4abe29bbcb4458ef5abdecdfcaaf3837d0a15321a49bc97c20310f92f76b84a2; HideMouse: 1a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8.
- [File Hash] Additional tool and utility hashes – WebBrowserPassView: 36541fad68e79cdedb965b1afcdc45385646611aa72903ddbe9d4d064d7bffb9; Defender Control: bfa9c3298a749c8949f890ef02b4d07589bea1635150d57215b2f37b6f3acef0.
- [File Hash] LogMeIn / GoTo Resolve MSI examples – 951d9bd7842cbd6c31f57e271bccc624f0d8285a713b87ab928145930162f625; 9c6621b2ac227cc08878fa058d803f9fb067462f667400fd1854dc017405c933 (and many other Resolve MSI hashes listed).
- [Domain/URL] Malicious download and hosting URLs used in phishing – example: hxxps://gitlab[.]com/rockefellerroberth-stack/ui/-/raw/main/Dec_holidayparty[.]msi; hxxps://store3[.]gofile[.]io/download/direct/7cc1dc51-f000-42f1-abbd-7729f2e892ec/AdobeAcrobatReader[.]msi (many additional URLs listed).
- [File Name] Masqueraded installer names used as lures – document.clientsetup.msi, adobereaderdc.clientsetup.msi, AdobeReader[.]msi (used to impersonate legitimate installers).
Read more: https://www.security.com/threat-intelligence/rmm-logmein-attacks