Full Report
Recently, the Huntress SOC has observed threat actors increasingly use PDQ and GoTo Resolve to deploy further remote monitoring and management (RMM) tools in attacks.
Analysis Summary
# Tool/Technique: RMM Daisy-Chaining (PDQ & GoTo Resolve)
## Overview
This technique involves threat actors abusing legitimate Remote Monitoring and Management (RMM) tools to gain initial access and establish persistence. Specifically, attackers are "daisy-chaining" these tools—using one legitimate RMM (like PDQ or GoTo Resolve) to deploy a second, often rogue, RMM instance (like ScreenConnect or SimpleHelp). This method allows attackers to maintain redundant access points and evade detection by leveraging the trusted nature of these administrative tools.
## Technical Details
- **Type:** Technique (Living-off-the-Land / Tool Abuse)
- **Platform:** Windows
- **Capabilities:** Persistence, Remote Command Execution, File Deployment, Redundant Access.
- **First Seen:** Reported December 2025 (observed in activity starting September/October 2025).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- [T1133 - External Remote Services]
- **[TA0005 - Defense Evasion]**
- [T1218 - System Binary Proxy Execution]
- [T1036.005 - Masquerading: Match Legitimate Name or Location]
- **[TA0011 - Command and Control]**
- [T1219 - Remote Access Software]
## Functionality
### Core Capabilities
- **Initial Execution:** Renamed RMM installers (e.g., GoTo Resolve or PDQ) are delivered via phishing lures to bypass basic filename filters.
- **Redundant Persistence:** If one RMM tool is discovered and removed, the secondary or tertiary tool remains active.
- **Trusted Communication:** Traffic communicates with legitimate vendor infrastructure, making it difficult for network security tools to distinguish between malicious and administrative activity.
### Advanced Features
- **Service Creation:** Automated creation of Windows Services or Scheduled Tasks (e.g., using `sc.exe`) to ensure the RMM agent starts on boot.
- **Configuration Masking:** Use of JWrapper-based RMM deployments (SimpleHelp) where C2 details are buried in XML configuration files (`serviceconfig.xml`).
## Indicators of Compromise
- **File Hashes (SHA256):**
- `f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e` (ScreenConnect Binary)
- **File Names:**
- `Open Revised Contract (2).exe` (GoTo Resolve)
- `276Special%10Invitation9756.msi` (PDQ Installer)
- `NewAMG2908.exe` (SimpleHelp)
- `SimpleService.exe`
- **Network Indicators:**
- `hxxp[://]elegantparty[.]de` (Delivery domain)
- `stsmithchurchitems[.]shop` (SimpleHelp C2)
- **Behavioral Indicators:**
- Execution of `sc.exe start` targeting GoTo Resolve or other RMM services from unusual parent processes.
- Unexpected presence of `JWrapper-Remote Access` directories in `C:\ProgramData\`.
- Multiple RMM clients running on a single endpoint from different vendors.
## Associated Threat Actors
- Various unidentified cybercriminals using Social Engineering lures (Real Estate and Investment themes).
## Detection Methods
- **Behavioral Detection:** Monitor for "RMM on RMM" activity—instances where an RMM process (like PDQ) spawns an installer for a different RMM (like SimpleHelp or ScreenConnect).
- **Log Analysis:** Audit Scheduled Task creation and service starts (`sc.exe`) initiated by recently downloaded executables.
- **Inventory Audit:** Regularly cross-reference installed RMM software against an approved corporate list. Detect any unauthorized "JWrapper" or "SimpleHelp" instances.
## Mitigation Strategies
- **Software Restriction Policies:** Implement AppLocker or Windows Defender Application Control (WDAC) to block unapproved RMM binaries.
- **Identity Security:** Require Multi-Factor Authentication (MFA) for all legitimate RMM console logins to prevent account takeover.
- **Network Segmentation:** Limit the ability of RMM tools to communicate with the internet except for known, verified vendor IP ranges.
- **User Education:** Train staff to recognize phishing lures involving "Revised Contracts" or "Special Invitations" that require running `.exe` or `.msi` files.
## Related Tools/Techniques
- **ScreenConnect / ConnectWise Control**
- **Atera**
- **AnyDesk / TeamViewer**
- **Faronics Deploy**
- **Tiflux**