VENOMOUS#HELPER Phishing Campaign Uses Dual RMM Tools Against 80+ Organizations
Summary
Securonix reports that VENOMOUS#HELPER has affected 80+ organizations, mostly in the U.S. SSA-themed phishing delivers SimpleHelp with persistent access and SYSTEM-level privileges, then installs ScreenConnect as a fallback; the actor is unknown.
Key points
- Securonix says the campaign has been active since at least April 2025 and affected over 80 organizations, mostly in the U.S.; the operator is unknown.
- SSA-themed phishing directs victims through gruta[.]com[.]mx to a purported statement hosted at server[.]cubatiendaalimentos[.]com[.]mx.
- A JWrapper-packaged executable installs SimpleHelp 5.0.1 as a Windows service, with Safe Mode persistence and a watchdog that restarts it if stopped.
- The installed client reportedly enumerates registered security products and polls for user presence.
- The operators use SeDebugPrivilege and elev_win.exe to gain SYSTEM-level access for interactive desktop control.
- ConnectWise ScreenConnect is installed as a fallback, creating a redundant remote-access channel.
- Securonix says the activity overlaps with clusters tracked by Red Canary and Sophos, which calls one cluster STAC6405; it may align with an initial access broker or ransomware precursor operation.
Article Details
- Attack Vectors
- Phishing emails impersonating the U.S. Social Security Administration instructed recipients to download a purported statement from a link.
- The phishing link led to gruta.com[.]mx, described as a legitimate but compromised Mexican business website.
- The purported statement was an executable staged on attacker-controlled server.cubatiendaalimentos.com[.]mx and packaged with JWrapper.
- Opening the executable installed SimpleHelp as a Windows service with Safe Mode persistence and a watchdog that restarted it if stopped.
- SimpleHelp used SeDebugPrivilege and elev_win.exe to obtain SYSTEM-level access; ConnectWise ScreenConnect was then installed as a fallback remote-access channel.
- Defensive Notes
- The researchers said standard antivirus and signature-based controls may see only legitimately signed RMM software during this activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gruta[.]com[.]mx | Compromised business website used as the link destination in SSA-themed phishing emails. |
| DOMAIN | server[.]cubatiendaalimentos[.]com[.]mx | Attacker-controlled domain used to stage the executable that delivered SimpleHelp. |
MITRE ATT&CK
T1105 · Ingress Tool TransferThe executable was downloaded from the attacker-controlled staging domain, and ScreenConnect was subsequently downloaded and installed as a fallback.T1204.002 · Malicious FileVictims were tricked into opening a JWrapper-packaged Windows executable posing as an SSA statement.T1219 · Remote Access ToolsThe operators used SimpleHelp and ConnectWise ScreenConnect for persistent remote access, with ScreenConnect serving as a fallback channel.T1518.001 · Security Software DiscoveryThe malware periodically enumerated registered security products through the rootSecurityCenter2 WMI namespace.T1543.003 · Windows ServiceThe malware installed SimpleHelp as a Windows service for persistence.T1566.002 · Spearphishing LinkSSA-themed phishing emails directed recipients to a link for a purported statement.
People
Aaron BeardsleeNamed as a researcher who analyzed the SimpleHelp and ScreenConnect deployment in the report.Akshay GaikwadNamed as a researcher who analyzed the SimpleHelp and ScreenConnect deployment in the report.Shikha SangwanNamed as a researcher who analyzed the SimpleHelp and ScreenConnect deployment in the report.
Threat Actors
Vendors
Products
ConnectWise ScreenConnectthat installs SimpleHelp as a service, elevates privileges for full desktop control, and stages ConnectWise ScreenConnect as a redundant fallback, impacting over 80 organizations primarily in the U.S.Microsoft WindowsThe malware installs as a Windows service with Safe Mode persistence and a self-healing watchdog.SimpleHelpThe operation delivers a JWrapper-packaged executable that installs SimpleHelp as a service, elevates privileges for full desktop control, and stages ConnectWise ScreenConnect as a redundant fallback, impacting over 80