Fraud Management & Cybercrime
,
Governance & Risk Management
,
Ransomware
VoidCrypt Ransomware Variant Taps RMM Tools, Says Huntress
Management isn’t the only advocate for employee monitoring software, according to new research from cybersecurity firm Huntress. Ransomware hackers also find them highly useful.
Threat intel published by the firm Wednesday detailed two early 2026 incidents in which hackers used Net Monitor for Employees Professional and SimpleHelp for nefarious ends – in one case attempting to deploy “Crazy” ransomware, a variant belonging to the VoidCrypt ransomware family.
“In the cases observed, threat actors used these two tools together, using Net Monitor for Employees as a primary remote access channel and SimpleHelp as a redundant persistence layer,” Huntress researchers wrote in a blog post.
The name “Net Monitor for Employees Professional” suggests a passive productivity monitoring tool, but it comes bundled with an interface enabling remote execution of commands. “This dynamic blurs the lines between a passive monitoring tool and a fully-fledged RMM tool,” Huntress noted.
At the end of January, Huntress said it detected an instance of the software running a Net Monitor terminal-like executable. Hackers used it to download SimpleHelp, from which they made commands including attempting to tamper with Windows Defender.
Huntress said it wasn’t sure how hackers compromised Net Monitor in the first place.
A second hacking incident included a clearer picture, including the original threat vector. Hackers in that case used a compromised VPN account to obtain access to a corporate network, download Network Monitor shortly afterward.
They configured Net Monitor to call back to a command-and-control website through port 443, the same server port at HTTPS and one that firewalls are configured to let through. They also used a built-in configuration parameter to register the Net Monitor on the Windows desktop as OneDriveSvbc with a process name of OneDriver.exe – obviously an attempt to hide the presence of the remote monitoring and management software by disguising it as a Windows service. They then renamed the running process to svchost.exe, “a ubiquitous Windows system process.”
As with the earlier incident, hackers additionally installed SimpleHelp. They directed the SimpleHelp agent to search the desktop for cryptocurrency-related keywords, as well as keywords associated with remote access, “likely to detect if anyone was actively connecting to the machine.”
These incidents are hardly the first instances of hackers discovering that RMM tools – simultaneously open to remote connections and with privileged local access – are good for wiggling into corporate networks. Cybersecurity firm Arctic Wolf in early 2025 observed hackers using SimpleHelp as an initial access vector. Sophos in spring 2025 said it had medium confidence that hackers chained vulnerabilities to gain access to a managed service provider’s instance of SimpleHelp.