Recent incident response engagements by Huntress Tactical Response have identified multiple sophisticated intrusions in which legitimate remote monitoring tools — specifically Net Monitor for Employees Professional (a workforce monitoring product) and SimpleHelp (a commercial Remote Monitoring and Management/RMM platform) — were weaponized to establish long-term footholds, create out-of-band remote access channels, and facilitate ransomware deployment. Evidence from overlapping filenames, shared command-and-control (C2) infrastructure, and repeated tradecraft strongly indicate these incidents are linked to a single threat actor or group.
Key Technical Findings:
- The “employee monitoring” tool Net Monitor for Employees Professional (NetworkLookout) is being repurposed as a Remote Access Trojan (RAT) due to built-in remote shell, desktop control, and file transfer capabilities.
- SimpleHelp, widely used for legitimate IT support and management, is abused as a secondary persistence and control layer.
- Deployment chain evidenced compromised perimeter access, stealthy silent installations, masquerading, and credential misuse.
- At least one intrusion culminated in attempted Crazy ransomware deployment, with multiple executables staged for execution.
Understanding the Tools Turned Threat Vectors
Net Monitor for Employees Professional
Although branded as employee productivity monitoring software, this product natively includes:
- Interactive remote desktop viewing and control
- File upload/download and management interfaces
- Execution of an embedded pseudo-terminal (
winpty-agent.exe) enabling full shell interaction - Customizable service/process names at install time
These capabilities mean that when installed by an adversary, the tool operates essentially as a RAT — indistinguishable from standard administrative RMM products.
SimpleHelp RMM Platform
SimpleHelp is a legitimate RMM platform with features attractive to system administrators:
- Lightweight persistent agents
- Gateway redundancy and fail-over support
- Connectivity over common ports (e.g., HTTPS/443)
- Capability to serve remote access sessions
Such properties make it ideal for threat actors to establish resilient post-exploitation channels that blend into normal enterprise traffic.
Detailed Case Analyses
Case #1: Unspecified Initial Vector → RAT Abuse → Ransomware Stage
- Initial Discovery: Investigators first observed unusual account manipulation commands on a host, triggered by a remote management interface. Commands exhibited full account enumeration and attempts to manipulate built-in accounts — including enabling the local Administrator account.
- Process Tree Artifacts: Analysis showed that commands and system processes were being spawned from the “Net Monitor for Employees” executable — itself launched via the pseudo-terminal (
winpty-agent.exe). - Binary Retrieval: The RAT component was observed pulling a file named
vhost.exevia PowerShell from a remote IP — later determined to be a renamed SimpleHelp agent. - Post-Compromise Behavior:
- Execution of commands for reconnaissance (e.g., system information gathering, network probing)
- Defender tampering attempts (e.g., Windows Defender service disablement via registry manipulation)
- Multiple Crazy ransomware binaries staged (
encrypt.exe,encrypt − Copy (2).exe, etc.) — indicating iterative attempts to deploy the payload.
Case #2: Credential Compromise → Stealth Installation → Dual RMM Channels
- Access Vector: Initial access came via a vendor SSL VPN account compromise, facilitating RDP access to a domain controller.
- Deployment Technique: The adversary executed a silent MSI installation (
msiexec) of the Net Monitor agent — sourcing the installer directly from the vendor site and configuring it to masquerade as legitimate Windows system processes:- Service renamed to
OneDriveSvc - Process named
OneDriver.exe - Runtime process renamed to
svchost.exe
- Service renamed to
- SimpleHelp Installation: The attacker also installed SimpleHelp as service
Remote Access ServiceunderC:\ProgramData\JWrapper-Remote Access, connecting back to malicious gateways for persistent remote sessions. - Keyword-Triggered Monitoring: The SimpleHelp agent was configured with keyword event triggers targeting:
- Cryptocurrency wallets and exchanges (e.g., metamask, binance, etherscan)
- RMM/remote access terms (e.g., RDP, AnyDesk, TeamViewer)
Adversary Tradecraft Patterns
Common techniques identified across both cases include:
- Masquerade of malicious executables under benign process and service names
- Use of dual remote access channels (one for interactive operations, one for persistence)
- Silent software installation via standard system utilities
- Keyword monitoring logic for opportunistic financial theft
- Resilient RMM configurations using redundant gateways
The reuse of the same filename (vhost.exe) across different installs and shared C2 infrastructure domains/IPs strongly supports attribution to a single campaign cluster rather than independent compromise events.
Indicator Sets (IOCs)
| Indicator | Description |
|---|---|
dronemaker[.]org | Net Monitor C2 |
104.145.210.13 | Net Monitor C2 |
192.144.34.35 | Net Monitor C2 |
160.191.182.41 | SimpleHelp host |
192.144.34.42 | SimpleHelp C2 |
telesupportgroup[.]com | SimpleHelp C2 |
microuptime[.]com | SimpleHelp C2 |
File ext .crazy | Ransomware extension |
| SHA-256: winpty/net monitor binaries | Persistence executables |
| SHA-256: vhost.exe | SimpleHelp agent |
| SHA-256: encrypt.exe | Ransomware sample |
Defensive Recommendations
To mitigate similar threats, organizations should adopt a layered strategy:
Perimeter and Access Controls
- Enforce Multi-Factor Authentication (MFA) for all remote access (VPN, RDP, VDI)
- Apply strict principle of least privilege
- Segment networks to contain breach propagation
- Patch and monitor VPN and remote access gateways for anomalous activity
Software Governance and Monitoring
- Scrutinize all third-party tools with administrative capabilities
- Restrict software installs and enforce application whitelisting
- Detect anomalous process chains (e.g.,
msiexecsourcing installers externally) - Alert on defensive tampering attempts (EDR/Defender service modifications)
Account Hygiene
- Disable or rename default system accounts
- Enforce strong password policies
- Periodically audit account creation and privilege escalations
Conclusions & Strategic Insights
This set of intrusions exemplifies a broader trend: threat actors increasingly leverage legitimate administrative tools as dual-use mechanisms to evade detection while conducting destructive operations. By abusing commercial RMM and monitoring products, attackers not only gain interactive access but also establish resilient persistence and reconnaissance channels that blend with normal administrative traffic — complicating detection.
Networks must evolve beyond simple signature-based detection to behavioral baselines, robust identity defenses, and zero-trust principles to counter such sophisticated dual-use threats effectively.
