Threats

Crazy Ransomware Operator Weaponizes Employee Monitoring Software for Stealth Persistence

Zero Day Wire

11 Feb 2026 — 2 min read

A Crazy ransomware affiliate is abusing legitimate employee monitoring software and remote support tools to maintain stealth persistence inside corporate networks, blending malicious activity with normal administrative operations before deploying ransomware.

Researchers at Huntress investigated multiple intrusions where the threat actor deployed Net Monitor for Employees Professional alongside the SimpleHelp remote access client — both legitimate tools that allowed the attacker to operate undetected within standard enterprise tooling.

Initial Access and Persistence

Both observed breaches were enabled through compromised SSL VPN credentials. Once inside, the attacker installed Net Monitor for Employees Professional using the Windows Installer utility (msiexec.exe), pulling the agent directly from the developer's website. The tool provided full interactive access — remote desktop viewing, file transfer, and command execution on compromised systems.

The attacker attempted to activate the local administrator account via net user administrator /active:yes and established redundant persistence by downloading the SimpleHelp remote access client through PowerShell. The SimpleHelp binary was disguised using filenames mimicking legitimate processes — vshost.exe (resembling Visual Studio) and OneDriveSvc.exe staged under C:\ProgramData\OneDriveSvc\.

This dual-tool approach ensured continued access even if one tool was discovered and removed.

Pre-Deployment Reconnaissance

In one intrusion, the attacker configured monitoring rules within SimpleHelp to trigger alerts when victims accessed cryptocurrency wallets or remote management tools. Huntress observed the agent continuously cycling through triggers for cryptocurrency-related keywords including wallet services (MetaMask, Exodus, Blockchain), exchanges (Binance, Bybit, KuCoin, Bitrue, Poloniex), blockchain explorers (Etherscan, BscScan), and the payment platform Payoneer.

The agent simultaneously monitored for remote access tool keywords — RDP, AnyDesk, UltraView, TeamViewer, and VNC — likely to detect if administrators were actively connecting to the compromised machine.

Defense Evasion

The attacker attempted to disable Windows Defender by stopping and deleting associated services, removing the primary endpoint protection before ransomware deployment.

Attribution

While only one incident progressed to actual Crazy ransomware deployment, Huntress assessed both intrusions were conducted by the same operator based on reused filenames (vhost.exe) and overlapping command-and-control infrastructure.

Recommendation

Organizations should monitor for unauthorized installations of remote monitoring and employee surveillance tools, which increasingly serve as attacker persistence mechanisms that blend into legitimate network traffic. Enforce MFA on all SSL VPN and remote access services — both observed intrusions began with compromised VPN credentials. Audit for unexpected SimpleHelp, Net Monitor, or similar RMM tool deployments. Alert on msiexec.exe pulling installers from external sources and PowerShell downloading executables into ProgramData directories.

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors