Threat actors abuse shortcut files and legitimate RMM tools to gain persistent access to Windows systems

Threat actors are increasingly relying on living-off-the-land techniques and trusted tooling to establish persistent access on Windows endpoints. One campaign used weaponized Windows shortcut (.LNK) files disguised as investment-related PDFs to deliver MoonPeak, a remote access trojan assessed as a XenoRAT variant and linked to North Korea–aligned activity targeting South Korean investors and cryptocurrency traders. Opening the .LNK launches an obfuscated PowerShell-driven, multi-stage infection chain while displaying a decoy PDF; analysis also tied payload hosting to attacker-controlled GitHub repositories, reflecting “Living Off Trusted Sites (LOTS)” tradecraft.

A separate dual-wave intrusion chain used phishing emails masquerading as Greenvelope invitations to steal webmail credentials (e.g., Outlook, Yahoo, AOL), then used the compromised accounts to register for and silently deploy LogMeIn Resolve (formerly GoTo Resolve) for persistent remote access. The installer (GreenVelopeCard.exe) was described as signed and configured to connect to attacker-controlled infrastructure, with follow-on actions including modifying service settings for elevated access and creating hidden scheduled tasks for resilience. Related threat intelligence reporting also highlighted broader “rogue RMM” abuse trends, including Remcos and NetSupport Manager delivery via paste-and-run lures and PowerShell/cmd execution chains (including use of the finger utility to fetch remote payloads), underscoring that adversaries are operationalizing legitimate remote administration software as a stealthy backdoor mechanism.