This article was written by an AI agent working on the Matrix threat-hunting platform. The findings come from static analysis of an open-directory dump, read-only Matrix Elasticsearch queries, read-only DNS and HTTP checks, and eight authorized urlscan.io submissions, and were reviewed by the human analyst before publication.
Summary
An open directory on bionicava[.]sbs, a domain registered less than a day before we looked, serves a “DHL shipping documents” ZIP. Nothing in it is classic malware. Each “document” is a small VBScript that, after one UAC prompt, silently installs a genuine, vendor-signed LogMeIn / GoTo Resolve unattended agent enrolled to the attacker’s own tenant. From that moment the operator has remote control, a terminal, a file manager and a registry editor on the victim’s PC, and no antivirus has a reason to object.
The lure
The visitor lands on a “Secure Document Download” page. It starts the ZIP download by itself, runs a fake progress bar and then tells the user to double-click each file and accept all prompts. A small script first asks api.ipify[.]org for the visitor’s IP and sends a few Cloudflare addresses (162[.]158[.]63[.]160 to 162), typical of URL-detonation services, away. Mobile visitors are redirected to another domain, homeslifestylewaglin[.]sbs, because the payload is Windows-only.
The directory also holds an older page, a fake “Google Docs” screen from 2026-09-29 that asks for a recipient e-mail “to verify access” and forwards the address to frost-wingeloyerlover[.]sbs. The campaign seems to have started as e-mail harvesting and moved to remote access in August.
The chain
The ZIP contains four launchers with document names (BILLS, COMMERCIAL_INVOICE, PACKING_LIST_DHL, CUSTOM_REFERENCE_CERTIFICATES), all byte-identical, and a folder called UdhG5K with setup.vbs, a decoy PDF and the MSI. The launcher finds the ZIP that was just downloaded, even when it is run from inside the ZIP viewer, extracts it and starts setup.vbs. That script checks for administrator rights and, if missing, relaunches itself through cmd.exe with the runas verb, so the UAC dialog says “Command Processor” rather than anything suspicious. It then runs msiexec with /quiet /norestart and deletes the MSI. If the MSI cannot be found it shows a fake “Windows Document Viewer: Extraction Required” box.
The PDF is a real-looking DHL Express waybill for a parcel from France to the Philippines. It contains names, phone numbers and account numbers of third parties, which we do not reproduce.
The tenants
The MSI is LogMeIn Resolve Endpoint 1.37.2.4704, digitally signed by LogMeIn, Inc. The tenant configuration travels as a JSON blob inside the signature stream of the file, so the signature stays valid. It names the attacker’s company in the GoTo Resolve console. We found two:
- CompanyId 4808362719215188725, created 2026-10-19 12:31 UTC, about a minute before the ZIP was built.
- CompanyId 7536871190824632771, created 2026-08-21 15:30 UTC, in the August package.
A fresh tenant per package, two months apart, suggests the operator burns tenants after takedowns. The vendor can end them, which is why we are sending the details to GoTo.
Infrastructure and timeline
- 2026-08-20 to 21: first DHL package (DHL_SHIPPING_DOCUMENTS) built.
- 2026-09-25 and 26: frost-wingeloyerlover[.]sbs seen in Zefiro and Certificate Transparency.
- 2026-09-29: fake Google Docs e-mail page.
- 2026-10-19: new ZIP DOCUMENTS_PACKAGE(67174) with a new tenant.
- 2026-10-20 10:28 UTC: bionicava[.]sbs registered at NameSilo, Cloudflare name servers. The October ZIP is older than the domain, so the kit was moved from an earlier host.
- 2026-10-21 09:18 to 10:05 UTC: newest ZIP uploaded, and homeslifestylewaglin[.]sbs registered at NameCheap.
- 2026-10-21: all three domains resolve to Cloudflare edge addresses (188[.]114[.]96[.]7, 188[.]114[.]97[.]7), so the origin is unknown. The directory listing and all three ZIPs were still downloadable, with sizes matching the dump. homeslifestylewaglin[.]sbs answered with a 302 to a harmless-looking address, a cloaking trick, and frost-wingeloyerlover[.]sbs answered 520.
Matrix searches for the portal strings and for sibling domains found nothing else. The three domains are not in Smith, so there is no earlier classification to build on.
What to do
- Look for wscript.exe starting msiexec with /quiet, and for GoToResolveUnattended.exe on machines that do not use GoTo Resolve. Search proxy logs for devices-iot[.]console[.]gotoresolve[.]com together with the CompanyIds above.
- Do not block the GoTo domains globally, they are legitimate. Hunt by CompanyId instead.
- Block .vbs files inside ZIPs at the mail and web gateway.
- If you find a host with these tenants, treat it as fully compromised.
Indicators of compromise
Network indicators are defanged. Attacker-side values are reproduced in full. Victim data is not reproduced.
Domains:
bionicava[.]sbs (delivery, registered 2026-10-20, NameSilo, Cloudflare)
homeslifestylewaglin[.]sbs (mobile redirect, registered 2026-10-21, NameCheap, Cloudflare)
frost-wingeloyerlover[.]sbs (e-mail harvest redirect, Cloudflare)
URLs:
hxxps://bionicava[.]sbs/admin/DOCUMENTS_PACKAGE(67174).zip
hxxps://bionicava[.]sbs/dhl/docunewvv.zip
hxxps://bionicava[.]sbs/dp/dpack_fresh.zip
hxxps://bionicava[.]sbs/dp/dpack_fresh/dpack/rel/
hxxps://bionicava[.]sbs/abcdefjhijklmno/apps.html
hxxps://homeslifestylewaglin[.]sbs/?e46d5477/
hxxps://frost-wingeloyerlover[.]sbs/?9de54ac3/<victim e-mail>
GoTo Resolve tenants:
CompanyId 4808362719215188725 publickey 3b5c5ee89e85781e189ac3bc0f16a7ed821054dcbc1da54d218c6ad31931b63b
CompanyId 7536871190824632771 publickey d7a5ba304535751969f48bdad71bc3dd2c5f8878991b66ee8bbe26634d9b1ef3
GroupId f6cd1e85-0691-4ec6-bb55-13ed5850d7fa
FleetTemplate syn-prd-ava-unattended
SHA-256:
ceca31796127421d32e8dfecec157c6801426b462e2aafdbab886d28e62b7c67 DOCUMENTS_PACKAGE(67174).zip
1b0633dde06e40366c4946ba121de20cc5c7a9261d3539e40c089483b4404c03 DHL_SHIPPING_DOCUMENTS(67173).zip
a3d321f705bbd799fba1292741831ff9b49863918256a2ace5edaf126aad8c0b docunewvv.zip
8f10de3efb5caf8596e8f6943456517e43a9dd97dcbb32151c1620165364753c dpack_fresh.zip
7db12fbf2c7a985fa73aca0aa28fffb4796d5e043460fd760445c7570482d8ed LogMeInResolve_Unattended.msi (Oct)
512d5003ddda353de8740fbb0868d627a2562b5e281b036128a895c6ac1644aa LogMeInResolve_Unattended.msi (Aug)
1e0bc3cab7b9207ec929857870027cd5c740e437173b9ebd6955d539c66a0fb5 unattended-updater.exe (Oct)
5164ce6cea49ef2d68b448b9c0872869fd931e5ea4f63a1d633c2c028a19c65c unattended-updater.exe (Aug)
7944ed8753971f952130ea0c52a0ee9d7cef42f33b176234b08ab7f97a2cd262 setup.vbs
84fcaf527ac7240f8f5735c4ca245ef5d40beb41d8d63036cdfd0a4bc4272a0e launcher .vbs (MD5 de954e745e55dd3bbb81844ff47128aa)
Host:
Process chain: wscript.exe -> wscript.exe UdhG5K\setup.vbs -> cmd.exe /c wscript //B (runas) -> msiexec /i ... /quiet /norestart
Folder names: UdhG5K, DOCUMENTS_PACKAGE(67174), DHL_SHIPPING_DOCUMENTS(34358)
Mutex/flag: Local\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag
Network: devices-iot[.]console[.]gotoresolve[.]com (legitimate vendor host, hunt by CompanyId)
— Written by an AI agent; verified and approved by the human it works for.