Threat Actors Chain Net Monitor and SimpleHelp in Two Intrusions
Summary
Huntress traced two intrusions using Net Monitor for Employees and SimpleHelp for remote access and persistence. One involved an attempted Crazy ransomware deployment; shared infrastructure suggests the cases may share an operator.
Key points
- In one case, Huntress observed a threat actor using a compromised vendor SSL VPN account to gain initial access, then installing Net Monitor and SimpleHelp.
- Net Monitor’s bundled winpty-agent.exe enabled command execution, reconnaissance, and delivery of additional tools.
- The attacker disguised Net Monitor as OneDrive using names including OneDriveSvc and OneDriver.exe, and renamed its running process to svchost.exe.
- SimpleHelp provided a second remote access channel; its keyword triggers monitored cryptocurrency services and other remote access tools.
- In the other case, the attacker attempted to deploy Crazy ransomware, a VoidCrypt-family variant; Huntress observed multiple copies of the binary after apparent execution issues.
- Reused vhost.exe filenames and overlapping infrastructure, including dronemaker[.]org, led Huntress to assess that the two cases strongly suggest a shared operator or group.
Article Details
- Attack Vectors
- Case #2 began with access through a compromised vendor SSL VPN account, followed by an RDP connection to a domain controller.
- The operators installed Net Monitor for Employees Professional and used its built-in shell to download and execute a renamed SimpleHelp agent.
- SimpleHelp was installed as a service to provide a redundant remote-access channel; its agent used gateway servers and keyword triggers monitoring cryptocurrency and remote-access activity.
- In Case #1, the initial access method was unknown. The operators used Net Monitor and SimpleHelp, attempted account manipulation and Windows Defender tampering, and attempted to deploy Crazy ransomware.
- Defensive Notes
- Enforce MFA on VPN, RDP, VDI, administrative accounts, and external-facing applications; apply least privilege and network segmentation.
- Patch and monitor external-facing VPN and RDP infrastructure, and investigate anomalous login attempts.
- Audit third-party RMM and employee-monitoring software, restrict software installation, and use application controls against unauthorized executables.
- Monitor unusual process chains, remote-source msiexec installations, RMM tools deploying other RMM tools, and attempts to modify or disable security software.
- Audit accounts for newly created, enabled, or manipulated accounts; disable or rename default accounts and enforce strong, unique passwords.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dronemaker[.]org | Attacker-controlled Net Monitor command-and-control domain and SimpleHelp gateway. |
| DOMAIN | microuptime[.]com | Configured SimpleHelp gateway; the article reports that connection attempts were consistently rejected. |
| DOMAIN | telesupportgroup[.]com | SimpleHelp gateway server used by the agent. |
| IPV4 | 104[.]145[.]210[.]13 | Network Monitor for Employees command-and-control address identified in the article. |
| IPV4 | 160[.]191[.]182[.]41 | SimpleHelp application host used to retrieve updates and components. |
| IPV4 | 192[.]144[.]34[.]35 | Additional command-and-control endpoint added to the Net Monitor agent. |
| IPV4 | 192[.]144[.]34[.]42 | SimpleHelp command-and-control endpoint configured for the agent. |
| SHA256 | 0b7801af15b6d13b242e8ec53e365b42e2b37edc0fd3e182c94b7d64814d0993 | SHA-256 identified for the renamed SimpleHelp executable vhost.exe. |
| SHA256 | 0d332b4f5dc9c98097ccbda31847b85c1780c1a02764db3adcbaf67158fbffd0 | SHA-256 identified as the Net Monitor control-agent service persistence artifact. |
| SHA256 | aadf879d5a37de295e6a331aaa38fd138c50317761d6bb97f91d2f354790434e | SHA-256 identified for the attempted Crazy ransomware executable encrypt.exe. |
| SHA256 | b21f3a77031bccc6f7feb03916a6734e6823328786f993457503c5960b67922b | SHA-256 listed among the article's indicators for this activity. |
| URL | hxxp[:]//160[.]191[.]182[.]41/access/ | SimpleHelp update and component download URL on the identified application host. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe operator ran ipconfig /all to enumerate the compromised host's network configuration.T1018 · Remote System DiscoveryThe operator used ping commands to probe internal network segments.T1021.001 · Remote Desktop ProtocolAfter VPN access, the operator connected to a domain controller using Remote Desktop Protocol.T1036.004 · Masquerade Task or ServiceThe Net Monitor agent was disguised with the service name OneDriveSvc and process name OneDriver.exe.T1036.005 · Match Legitimate Resource Name or LocationThe running Net Monitor process was renamed svchost.exe to resemble a Windows system process.T1059 · Command and Scripting InterpreterThe Net Monitor pseudo-terminal enabled command execution, including net commands, ping, and ipconfig /all.T1059.001 · PowerShellThe operator launched an interactive PowerShell session and used PowerShell to download vhost.exe.T1098 · Account ManipulationThe operator attempted to create user accounts, reset passwords, and enable the built-in Administrator account.T1112 · Modify RegistryThe operator attempted Windows Defender tampering through Windows registry modification.T1133 · External Remote ServicesThe operators entered Case #2 through a compromised vendor SSL VPN account.T1219 · Remote Access ToolsNet Monitor for Employees Professional and SimpleHelp were abused as remote-access tools, including a redundant SimpleHelp access channel.T1486 · Data Encrypted for ImpactThe operator attempted to deploy Crazy ransomware binaries in Case #1.T1543.003 · Windows ServiceSimpleHelp was installed as a Windows service named Remote Access Service.
People
Anna PhamNamed article author.Anton OvrutskyNamed article author.Craig SweeneyCredited for work triaging and iterating on detections for the reported activity.Dray AghaNamed article author.Matt AndersonCredited for work triaging and iterating on detections for the reported activity.Michael TiggesNamed article author.Nick RoddyCredited for work triaging and iterating on detections for the reported activity.Tanner FilipCredited for work triaging and iterating on detections for the reported activity.
Malware
Crazyand SimpleHelp as a redundant persistence layer, ultimately leading to the attempted deployment of Crazy ransomware.VoidCryptthreat actor attempting to deploy multiple versions of “Crazy” ransomware, a variant belonging to the VoidCrypt ransomware family, dropping various binaries named encrypt.exe to disk.
Vendors
Products
Net Monitor for Employees ProfessionalNet Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout.SimpleHelpHomeBlogEmployee Monitoring and SimpleHelp Software Abused in Ransomware OperationsWindows DefenderFrom this point, the threat actor proceeded to execute various commands through the SimpleHelp RMM, including attempts at defense evasion via Windows Defender tampering:
Tools
nmep_agtconfig.exeShortly after, the threat actor reconfigured the agent using the software's native configuration utility nmep_agtconfig.exe, adding a third command-and-control endpoint at 192.144.34[.]35:443 alongside the original two.winpty-agent.exeDespite its name implying passive monitoring, Net Monitor for Employees Professional bundles a pseudo-terminal (winpty-agent.exe) that enables full command execution.