LogMeIn Resolve
LogMeIn Resolve is a legitimate remote monitoring and management (RMM) / remote access tool that has been abused by threat actors as an initial-access and persistence mechanism. Reported campaigns distributed LogMeIn Resolve from malicious download pages impersonating legitimate software and brands including Notepad++, 7-zip, Telegram, ChatGPT, and OpenAI. In these cases, installation registered the victim host with LogMeIn infrastructure, enabling attacker remote control; attackers then used it to execute PowerShell commands and install the PatoRAT backdoor. Separate phishing campaigns also used fake party invites to trick users into installing LogMeIn Resolve.
Since at least January 2025, LogMeIn Resolve has also been used by a cybercriminal cluster targeting trucking, freight, and logistics organizations as part of cyber-enabled cargo theft operations. Proofpoint reported the use of LogMeIn Resolve alongside other RMM tools including ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able, and Naverisk. Delivery methods included compromised load boards, email thread hijacking, and direct phishing campaigns with malicious URLs leading to .exe or .msi installers. After access was established, attackers used RMM tooling for system reconnaissance, credential harvesting, persistent control, and operational disruption, including blocking dispatchers, deleting bookings, and facilitating shipment hijacking. The activity has been associated with organized crime-linked cargo theft schemes primarily affecting food and beverage shipments.
The content characterizes LogMeIn Resolve abuse as part of a broader trend in which legitimate signed RMM software is used to evade traditional antivirus detection. AhnLab EDR detection noted in the reporting is Execution/EDR.LogMeIn.M12839.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
Adversaries frequently sign up for a free trial of a legitimate service (like LogMeIn Resolve or Syncro) using a throwaway email.
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Lateral Movement
1 technique
Lateral Movement
Command and Control
2 techniques
Command and Control
One of the most striking trends in recent campaigns has been the use of RMM tools as loaders for other RMM tools. Adversaries frequently sign up for a free trial of a legitimate service (like LogMeIn Resolve or Syncro) using a throwaway email. They then use that first tool to push a second, more permanent remote access tool—usually a cracked version of NetSupport Manager or a specially configured ScreenConnect instance.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate RMM tool abused as an initial access/remote control mechanism; attackers trick users into installing it via trojanized download pages and then use it to run commands and deploy additional malware (e.g., PatoRAT).
Legitimate RMM tool abused by attackers to gain and maintain remote access to compromised systems, often as part of phishing campaigns.
LogMeIn Resolve is a legitimate RMM tool leveraged by attackers to maintain unauthorized remote access to victim systems.
Legitimate RMM tool abused by attackers to remotely control victim systems, used as part of multi-stage attack chains targeting logistics and trucking companies.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.