The Skeleton Key: How Attackers Weaponize Trusted RMM Tools for Backdoor Access

KnowBe4 Threat Labs documents a two-wave attack: initial credential harvesting through convincing Greenvelope-themed phishing landing pages, followed by weaponization of stolen credentials to deploy legitimately signed RMM software (GreenVelopeCard.exe) that configures GoTo Resolve/LogMeIn for silent, unattended remote control. The report provides extracted JSON deployment configuration, describes SYSTEM-level privilege escalation via service and COM API abuse, lists C2 domains, and recommends hunting for IOCs, blocking C2 domains, and monitoring for unauthorized RMM usage.