RMM Tool Abused in Ransomware Attacks

The Two Incidents: What Happened

Case 1 — Late January 2026 (Unknown Initial Access)

In late January 2026, cybersecurity firm Huntress identified suspicious account manipulation activity on a compromised host, triggering an investigation into a broader intrusion. Attackers leveraged the legitimate employee monitoring software Net Monitor for Employees to manipulate system accounts, disable the Guest account, enable the built-in Administrator account, and execute multiple net commands to enumerate users, reset credentials, and create additional administrative accounts.

During the investigation, analysts observed activity from the Net Monitor console initiating a PowerShell download of a file named vhost.exe from IP address 160.191.182.41. The downloaded payload was later identified as SimpleHelp, a remote support platform.

In at least one instance, attackers installed Net Monitor for Employees Professional using the Windows Installer utility (msiexec.exe), pulling the agent directly from the vendor’s distribution infrastructure. Once deployed, the tool provided attackers with full interactive access, including desktop monitoring, file transfer capabilities, and remote command execution — effectively converting a legitimate monitoring application into a remote access trojan (RAT).

Attackers subsequently attempted to deploy ransomware, creating multiple copies of the encryption binary with incrementing names. This behavior suggests execution failures that the operator repeatedly tried to correct. Ultimately, Windows Defender successfully blocked the ransomware payload, preventing file encryption in this case.

Case 2 — Early February 2026 (VPN Compromise)

A separate intrusion in early February followed a different initial access route. Threat actors first compromised a third-party SSL VPN account, allowing entry into the target network. From there, they established an RDP connection to a domain controller, launched a PowerShell session, and installed the Net Monitor agent configured to establish a reverse connection back to an attacker-controlled console.

To avoid detection, the attackers disguised their activity through service and process masquerading. The malicious service was registered as OneDriveSvc, the executable was named OneDriver.exe, and the running binary was later renamed svchost.exe, blending malicious execution with legitimate Windows processes. This technique aligns with MITRE ATT&CK technique T1036 – Masquerading.

Using Net Monitor, the attackers performed network reconnaissance, enumerating internal network configurations and probing additional segments from the compromised domain controller.

SimpleHelp’s Role: Redundancy and Cryptocurrency Monitoring

In the second incident, the deployed SimpleHelp agent included monitoring rules configured around cryptocurrency-related keywords. These triggers covered cryptocurrency wallets, exchanges, blockchain explorers, and payment services, indicating the attackers were not only pursuing ransomware deployment but also monitoring opportunities for direct cryptocurrency theft.

Observed monitoring categories included wallet-related terms such as MetaMask, Exodus, wallet, and blockchain; exchange platforms including Binance, Bybit, KuCoin, Bitrue, Poloniex, BC.Game, and Noones; blockchain explorers like Etherscan and BSCScan; and payment services such as Payoneer.

The agent also monitored for other remote-access tools including RDP, AnyDesk, UltraView, TeamViewer, and VNC. Frequent trigger events suggested alerts were generated whenever these keywords appeared in active window titles or browser sessions, allowing attackers to detect administrator intervention or competing remote access sessions.

Attribution and Infrastructure Overlap

Infrastructure reuse, overlapping indicators of compromise, and consistent operational behavior across both incidents strongly indicate involvement of the same threat actor or affiliated group. Shared indicators include reuse of the vhost.exe filename and overlapping command-and-control infrastructure across both compromises.

VoidCrypt / “Crazy” Ransomware: Technical Context

The ransomware deployed in these incidents belongs to the VoidCrypt family, specifically the “Crazy” variant. VoidCrypt combines AES-256 encryption with RSA-based key protection, making recovery without attacker cooperation practically impossible once encryption completes.

Encrypted files receive extensions containing victim identifiers and attacker contact information, while ransom instructions are delivered through plaintext ransom notes dropped across affected systems. The naming and operational pattern closely matches other VoidCrypt variants such as Angry and Daz.

Broader Context: Ongoing Exploitation of SimpleHelp

These incidents occur within a wider trend of exploitation targeting SimpleHelp infrastructure following disclosure of multiple vulnerabilities in early 2025.

Three critical flaws have been actively abused:

Active exploitation began shortly after disclosure, with threat actors using SimpleHelp sessions to enumerate domain information through commands executed via cmd.exe, including tools such as net and nltest.

Later investigations uncovered ransomware groups chaining these vulnerabilities to compromise managed service provider (MSP) environments, push malicious installers, and exfiltrate data from downstream clients as part of double extortion campaigns.

Following widespread exploitation, CVE-2024-57727 was added to CISA’s Known Exploited Vulnerabilities catalog, and additional advisories were issued after ransomware groups leveraged unpatched systems to compromise service providers and their customers.

Defensive Measures and Mitigation Strategies

Security analysts emphasize several defensive measures to reduce exposure. Multi-factor authentication should be enforced across all remote access services and externally exposed systems. Organizations should adopt strict least-privilege access models and maintain accurate application inventories to detect unauthorized installations.

Deployment of remote monitoring tools such as Net Monitor for Employees should be restricted to systems without privileged access to critical infrastructure or sensitive data. Regular network audits are recommended to identify unauthorized or rogue remote management tools, which are frequently installed through phishing and social engineering attacks.

Continuous monitoring, timely patch management, and strict control over remote access platforms remain essential to defending against attacks that increasingly weaponize legitimate administrative tools.

References