Employee Monitoring and SimpleHelp Software Abused in Ransomware Operations

Summary

Threat actors abused Net Monitor for Employees and the SimpleHelp remote management platform to maintain persistent access to victim networks. By operating through legitimate commercial tools, the intruders blended in while downloading follow-on payloads and attempting to deploy Crazy ransomware (a VoidCrypt variant). Overlapping infrastructure—shared C2 domains and IP addresses—suggests the same operator across both incidents. The activity was profit-driven, combining credential/crypto theft monitoring with attempted ransomware extortion.

Investigation

Huntress documented two early-2026 intrusions where Net Monitor for Employees enabled reverse-shell capability and service masquerading, while SimpleHelp provided backup persistence. Analysts observed a renamed vhost.exe download, execution of winpty-agent.exe, and attempts to weaken defenses by tampering with Windows Defender settings. Initial access also involved compromised VPN credentials, and the tools were installed using silent msiexec execution. Multiple copies of the Crazy ransomware binary (encrypt.exe) were dropped, but the ransomware stage failed to run.

Mitigation

Prioritize MFA across all remote access paths, minimize privileged accounts, and segment networks to constrain lateral movement. Audit third-party admin tooling aggressively, and alert on suspicious process chains, silent msiexec installs, and service-name masquerading. Block or monitor known C2 infrastructure and use application control to prevent unauthorized RMM binaries from executing.

Response

If detected, isolate affected systems, stop malicious processes, and remove unauthorized RMM services. Preserve key artifacts (binaries, installer traces, logs), block related C2 domains/IPs, and reset any compromised credentials. Perform an environment-wide inventory of admin tools to validate legitimacy, then remediate registry changes and undo any Defender-tampering or security-control disablement attempts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Preparation: The attacker copies a benign Windows binary (calc.exe) to a file named nmep_agtconfig.exe, a watched suffix representing the SimpleHelp agent.
  2. Execution: The renamed binary is launched, causing Sysmon to log a process creation event whose Image ends with nmep_agtconfig.exe.
  3. Post‑execution: The attacker optionally runs a PowerShell one‑liner from within the spawned process to simulate command execution (illustrating T1059), but this extra behavior is not required for the rule to fire.

• Regression Test Script:

  # Simulation script – triggers the Sigma rule
  $src = "$env:SystemRootSystem32calc.exe"
  $dst = "$env:Tempnmep_agtconfig.exe"
  
  # Copy calc.exe to the masqueraded name
  Copy-Item -Path $src -Destination $dst -Force
  
  # Execute the masqueraded binary
  $proc = Start-Process -FilePath $dst -PassThru
  
  # Optional: within the same session, run a harmless command to generate command‑line telemetry
  Start-Process -FilePath "powershell.exe" -ArgumentList '-NoProfile -Command "Write-Host Simulated payload."' -NoNewWindow
  
  # Output PID for cleanup
  Write-Output "Spawned PID: $($proc.Id)"

• Cleanup Commands:

  # Terminate the masqueraded process if still running
  Get-Process -Name "nmep_agtconfig" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove the file from disk
  Remove-Item -Path "$env:Tempnmep_agtconfig.exe" -Force