Full Report
Huntress uncovers ransomware operations abusing employee monitoring software and SimpleHelp RMM for persistence, and ransomware deployment.
Analysis Summary
# Tool/Technique: Net Monitor for Employees & SimpleHelp Abuse
## Overview
This technique involves the dual-use abuse of legitimate administrative software—specifically **Net Monitor for Employees Professional** and **SimpleHelp RMM**—to establish persistent remote access and execute ransomware. Threat actors leverage these tools to bypass security controls by masquerading as authorized IT or monitoring services, eventually deploying **Crazy Ransomware**.
## Technical Details
- **Type:** Tool (Abuse of Legitimate Software) / Malware (Crazy Ransomware)
- **Platform:** Windows
- **Capabilities:** Remote desktop control, file management, reverse shell execution via `winpty-agent.exe`, and service masquerading.
- **First Seen:** January/February 2026
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1543.003 - Create or Modify System Process: Windows Service]**: Registering `OneDriveSvc` to run the agent.
- **[TA0005 - Defense Evasion]**
- **[T1036.005 - Masquerading: Device Driver/Service]**: Renaming binaries to `svchost.exe` and `OneDriver.exe`.
- **[T1218 - System Binary Proxy Execution]**: Using legitimate RMM binaries to execute malicious commands.
- **[TA0007 - Discovery]**
- **[T1087 - Account Discovery]**: Using `net` commands to investigate system accounts.
- **[TA0040 - Impact]**
- **[T1486 - Data Encrypted for Impact]**: Deployment of Crazy Ransomware.
## Functionality
### Core Capabilities
- **Remote Access:** Provides a full pseudo-terminal and remote desktop interface for hands-on-keyboard activity.
- **Persistence:** SimpleHelp RMM serves as a redundant secondary channel if the primary monitoring tool is removed.
- **Administrative Control:** Ability to disable accounts (e.g., Guest account) and modify system configurations.
### Advanced Features
- **Keyword Monitoring:** The SimpleHelp agent was configured to trigger alerts based on strings related to cryptocurrency (wallets, exchanges, blockchain explorers) and other remote access tools (RDP, AnyDesk, TeamViewer).
- **Customizable Installation:** Allows attackers to define custom service names and process names (e.g., mimicking Microsoft OneDrive).
## Indicators of Compromise
- **File Names:**
- `vhost.exe` (Commonly reused across cases)
- `OneDriver.exe`
- `svchost.exe` (when located in non-standard directories related to Net Monitor)
- `winpty-agent.exe`
- **Registry Keys:** Service registration under `OneDriveSvc`.
- **Network Indicators:**
- Infrastructure associated with SimpleHelp RMM gateways (specific IPs/domains defanged in original reports).
- **Behavioral Indicators:**
- `net.exe` or `cmd.exe` spawning from employee monitoring software processes.
- Unexpected installation of commercial monitoring tools in environments where they are not standard.
## Associated Threat Actors
- **Unidentified Single Operator/Group:** Linked by shared infrastructure and the specific use of "Crazy" ransomware.
## Detection Methods
- **Behavioral Detection:** Monitor for legitimate monitoring software (Net Monitor, SimpleHelp, AnyDesk) spawning shells (`cmd.exe`, `powershell.exe`) or system administration tools (`net.exe`, `ipconfig.exe`).
- **Service Monitoring:** Detect new services with high-privilege names (like `OneDriveSvc`) that point to non-standard or third-party binaries.
- **Process Auditing:** Look for the execution of `winpty-agent.exe`, which is often bundled with Net Monitor for terminal access.
## Mitigation Strategies
- **Software Whitelisting:** Implement Application Control to allow only approved RMM and monitoring tools.
- **Least Privilege:** Restrict the ability of standard users to install service-based software.
- **Network Segmentation:** Limit the outbound communication of administrative tools to known, authorized vendor endpoints.
- **Audit Monitoring Tools:** Regularly audit installed "Shadow IT" or employee tracking software that may have been installed without security oversight.
## Related Tools/Techniques
- **Komari:** Another monitoring tool recently observed being used as a SYSTEM-level backdoor.
- **RMM Abuse:** Similar to exploitation of Bomgar, AnyDesk, and ScreenConnect by various ransomware affiliates.
- **Crazy Ransomware:** The final payload associated with this specific campaign.