Cybercriminals Exploit Employee Monitoring and SimpleHelp Tools in Ransomware Attacks

The report describes two related intrusions in which threat actors abused legitimate remote monitoring and management tools (Net Monitor for Employees Professional and SimpleHelp) to establish persistence, conduct reconnaissance, and ultimately attempt to deploy Crazy ransomware (VoidCrypt family). Shared filenames (vhost.exe, encrypt.exe), overlapping C2 infrastructure (dronemaker.org, multiple IPs), and consistent techniques indicate a single operator or group; the actors also monitored cryptocurrency-related activity. Recommended defenses include enforcing MFA on remote access, hardening and monitoring VPN/RDP gateways, restricting administrative use of RMM tools, and applying network segmentation.