Threat Actors Exploit LogMeIn Resolve, ScreenConnect in Phishing Campaigns

Threat actors are abusing legitimate remote monitoring and management (RMM) tools LogMeIn Resolve and ScreenConnect in a multi‑stage phishing campaign that blends social engineering, living‑off‑the‑land techniques, and stealthy information‑stealing malware.

Sophos’ Managed Detection and Response (MDR) teams first saw this activity in April 2025, with most malicious activity clustered in October–November 2025.

More than 80 organizations were affected, largely in the US and spanning multiple sectors. The core objective of the campaign is to trick users into installing pre‑configured RMM agents that give attackers unattended remote access, often without dropping “traditional” malware in the first stage.

Sophos tracks this threat activity cluster as STAC6405 and assesses that parts of the infrastructure remain active, indicating an ongoing operation.

Researchers at Red Canary and Zscaler previously documented similar invite‑themed phishing that delivered RMM tools, and the latest Sophos investigation largely validates those findings.

Like those earlier operations, STAC6405 shows a clear shift toward using legitimate IT tools to establish and maintain footholds in victim environments.

Phishing lures and delivery

The attackers rely on themed invitations sent via phishing emails, sometimes from compromised third‑party accounts belonging to trusted partners, and sometimes from unknown senders.

Many messages mimic Punchbowl event invitations with subjects such as “SPECIAL INVITATION.” In contrast, others pose as tender or bid invitations, all of which carry links to attacker‑controlled distribution sites.

These sites host legitimate LogMeIn Resolve or ScreenConnect installers that are preconfigured to register the victim device to an attacker‑controlled account automatically.

Early on, the actor favored subdomains under a .ru[.]com‑style domain, later rotating to domains such as mastorpasstop[.]top, evitereview[.]de, and evitesecured[.]top, some of which embed “evite”‑like branding consistent with the invitation theme.

The landing pages themselves have been observed mimicking brands like Microsoft Teams and Norton, suggesting active tweaking of themes to improve lure credibility or evade simple pattern‑based detections.

Red Canary previously reported that related infrastructure dynamically redirected victims based on user‑agent strings and returned error pages to non‑Windows and non‑Android devices, although Sophos did not observe blocking behavior in its cases and was able to retrieve ScreenConnect installers from the same ecosystem.

When a user runs the downloaded binary (with names like Invitation.exe, ContractAgreementToSign.exe, or SPCL_INVITE_RSVP_2025.exe), LogMeIn Resolve silently installs and enrolls the endpoint into an attacker‑controlled tenant.

The agent writes a configuration file to disk containing a hard‑coded relay domain and registers a dedicated Windows service identified by a unique UID that ties back to that configuration, separate from any legitimate RMM deployment already present.

In most cases observed by Sophos, malicious activity stops after this initial access step, at least temporarily.

That idle behavior is consistent with initial access broker (IAB) activity, where operators quietly establish persistent access and then either “park” the foothold to monitor detection or sell it to other threat actors on underground markets.

In one incident, attackers moved quickly to a second stage less than an hour after the victim installed LogMeIn Resolve.

Instead of using the newly deployed agent, they leveraged a pre‑existing ScreenConnect installation to pull down a HeartCrypt‑packed ZIP archive (8776_6713_exe.zip) containing HideMouse.exe and 8776_6713.exe.

HideMouse.exe swaps the visible mouse cursor with a transparent one, concealing on‑screen activity to make remote control sessions less obvious to users.

The companion executable, 8776_6713.exe, is assessed as a malicious infostealer whose payload was injected into a legitimate game binary using HeartCrypt’s code‑injection capabilities.

The malware remains idle for roughly four to nine minutes using tight loop‑based delays, a common sandbox‑evasion tactic, before injecting into csc.exe, a known living‑off‑the‑land binary (LOLBin).

It then connects to command‑and‑control infrastructure at 45[.]56.162.138 and decrypts an embedded payload using TripleDES, exhibiting behavior similar to ValleyRAT loaders.

Post‑compromise actions include harvesting browser‑stored credentials and session data, attempting to access cryptocurrency wallets, enumerating host system information via WMI, and querying installed security products using WMI ExecQuery against AntiVirusProduct.

Alternate path: Bundled RMM chain

In another case, the initial payload was a ScreenConnect‑based installer, invite.exe, configured to join a session via relay[.]aceheritagehouse[.]top:8041 and grant interactive access to the attacker.

Beyond launching ScreenConnect as a service, the binary started a Java‑based remote access stack (RemoteAccess.jar and jwrapper_utils.jar) inside a bundled JRE, then enumerated firewall rules and abused SimpleService.exe from JWrapper to register its own service (simplegateway.service) and execute Remote Access.exe.

This secondary binary is believed to be tied to SimpleHelp, another legitimate RMM solution, and further invoked jwrapper.JWrapper with remoteaccess‑jar‑with‑dependencies.jar and supporting libraries to expand remote access options.

In coordination with the impacted customer, defenders were able to contain this incident before the attackers escalated further.

The STAC6405 campaign highlights the growing abuse of trusted third‑party services, from email accounts to commercial RMM platforms, to bootstrap access and persistence with minimal malware footprint.

For defenders, this underscores the need to treat RMM deployment and configuration changes as high‑value events, enforce strict allow‑lists for remote tools, and scrutinize invite‑themed attachments or executables, even when they appear to come from familiar senders.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.