Threat Actors Leveraging Employee Monitoring and SimpleHelp Tools to Deploy Ransomware Attacks

Cybercriminals are abusing legitimate employee-monitoring and remote-support tools (Net Monitor for Employees Professional and SimpleHelp) to establish long-term, stealthy access in corporate networks, rename agents to mimic Microsoft services (e.g., OneDriveSvc, OneDriver.exe), monitor screens for cryptocurrency-related activity (keywords like “wallet” and “Binance”), and prepare to deploy 'Crazy' ransomware while stealing funds; recommended mitigations include restricting software installation, enforcing MFA for remote accounts, auditing remote management tools, monitoring AV disablement attempts, and detecting suspicious program names.