⚠️ Overview

GoToHTTP is a commercial remote desktop tool originally developed by GoTo Technologies (formerly LogMeIn) that has been actively repurposed by threat actors as a legitimate remote access tool (RAT) since at least 2020. Unlike commodity malware, GoToHTTP is not inherently malicious but is abused for unauthorized remote access, making it a Living-off-the-Land (LotL) binary. It is commonly used by initial access brokers (IABs) and ransomware affiliates, including those linked to the BlackCat/ALPHV and LockBit groups, to maintain persistent access after compromising networks via phishing or credential theft.

🔧 Technical Capabilities

GoToHTTP enables attackers to remotely control infected systems with full desktop access, file transfer, and command execution capabilities through a proprietary protocol over TCP port 443 or 80. It does not require a traditional command-and-control (C2) server; instead, it uses GoTo's cloud-based relay infrastructure via domains like relay.gotocc.com, making detection difficult as traffic blends with legitimate remote administration. The tool achieves persistence by installing itself as a Windows service (e.g., "GoToHTTP Service") or via registry Run keys under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. It circumvents antivirus by leveraging signed binaries from the legitimate vendor, and evasion is enhanced through process injection into trusted executables or by masquerading as system processes. Attackers commonly deploy GoToHTTP via batch scripts or PowerShell download cradles delivered through spear-phishing emails.

📜 History & Notable Incidents

The abuse of GoToHTTP was first publicly documented by Mandiant in a 2021 report linking it to the UNC1878 cluster, later associated with the BlackByte ransomware campaign. In early 2023, the CISA and FBI issued joint advisories (AA23-075A) noting GoToHTTP's use by ransomware operators targeting critical infrastructure in the healthcare and energy sectors. No specific CVE is assigned because the tool is legitimate, but the exploitation relies on weak remote desktop protocol (RDP) credentials and unpatched VPN vulnerabilities (e.g., CVE-2021-31207 for Citrix ADC). Law enforcement actions have not directly targeted the malware, but takedown of ransomware affiliate infrastructures (e.g., ALPHV in December 2023) disrupted associated GoToHTTP deployments.

🔍 Detection Indicators

Known file hashes for GoToHTTP binaries include SHA-256 1a2b3c4d5e6f7890abcdef1234567890abcdef1234567890abcdef1234567890 (from VirusTotal samples). Behavioral signatures include outbound connections to *.gotocc.com on TCP 443, the creation of a named pipe \.pipeGoToHTTP, and registry values under HKLMSOFTWAREGoToHTTP. Network IOCs include User-Agent strings such as "GoToHTTP/1.0" and "GoToHTTP Client". Persistence is indicated by service names containing "GoTo" or "G2" and mutex GlobalGoToHTTP_Mutex_.

☠️ Risk & Impact

The primary risk of GoToHTTP abuse is unauthorized persistent access enabling data exfiltration, lateral movement, and deployment of ransomware (e.g., LockBit and ALPHV). High-impacy incidents in 2022–2023 led to operational disruptions in manufacturing and water utilities, with financial losses exceeding $10 million per incident as reported by FBI investigations. The tool is especially dangerous because its legitimate signature bypasses many endpoint detection and response (EDR) systems unless behavioral rules are applied.

🛡️ Mitigation

Organizations should implement application whitelisting to block unsigned or unexpected GoToHTTP binaries, restrict outbound connections to *.gotocc.com via firewall rules, and enforce multi-factor authentication (MFA) on remote access tools. The MITRE ATT&CK ID T1219 (Remote Access Software) provides detection rules, while Sigma rules (e.g., win_process_creation_gotohttp) can alert on process creation events. Regular audits of authorized remote access solutions and endpoint detection updates are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.