New PUA Exploits Legitimate IT Tool to Enable Silent Cyberattacks Researchers from Point Wild’s Lat61 Threat Intelligence Team have uncovered a Potentially Unwanted Application (PUA) tracked as HEURRemoteAdmin.GoToResolve.gen that covertly transforms a trusted IT support tool into a backdoor for cyber intrusions. The software, part of GoTo Resolve (formerly LogMeIn), installs silently in the background, embedding itself in C:\Program Files (x86)\GoTo Resolve Unattended\ without user notification. While GoTo Resolve is a legitimate remote administration tool, its installer contains a hidden file (32000~) that enables persistent, undetected operation, creating an unmonitored attack surface for threat actors. Of particular concern is the software’s use of Windows’ Restart Manager (RstrtMgr.dll), a component historically exploited by ransomware groups like Conti and Cactus, as well as the BiBi wiper, to disable security processes. By loading this library, the PUA could terminate antivirus or other protective services, leaving systems vulnerable to follow-on attacks. Despite bearing a valid digital signature from GoTo Technologies USA, LLC, the tool’s misuse potential remains high. Researchers warn that even signed applications can be weaponized, emphasizing the need for strict oversight of remote administration tools. Point Wild’s CTO, Dr. Zulfikar Ramzan, highlights this as part of a broader trend: "the exploitation of legitimate remote administration tools by threat actors," noting its ability to pre-position systems for destructive attacks while evading detection. Organizations are advised to verify and remove unauthorized instances of the software.

Remote access and collaboration company GoTo suffered a security breach where threat actors gained access to their development environment and third-party cloud storage service. GoTo started emailing customers and told them that they have started investigating the cyberattack with the help of Mandiant and have alerted law enforcement.