Crazy Ransomware Gang Exploits Employee Monitoring Tools for Attacks

The Crazy ransomware gang has recently been reported to exploit legitimate employee monitoring software, specifically Net Monitor for Employees Professional, alongside the SimpleHelp remote support tool. This combination allows them to maintain persistence within corporate networks while blending in with normal administrative activities. Researchers from Huntress discovered multiple incidents where these tools were used to facilitate ransomware deployment.

In one notable intrusion, attackers installed Net Monitor for Employees Professional using the Windows Installer utility, msiexec.exe, directly from the developer’s site. This method provided attackers with the ability to remotely view desktops, transfer files, and execute commands, effectively granting them full access to compromised systems.

Additionally, attackers attempted to activate the local administrator account to enhance their control over the network. They also downloaded and installed the SimpleHelp remote access client via PowerShell commands, disguising it with filenames similar to legitimate software, such as Visual Studio’s vshost.exe.

By executing the SimpleHelp payload, attackers ensured they could maintain remote access even if the employee monitoring tool was removed. They often disguised the SimpleHelp binary using filenames that mimicked OneDrive, further complicating detection efforts.

Researchers noted that the attackers monitored system activity in real-time, including cryptocurrency wallet access and remote management tools, as they prepared for ransomware deployment. This included tracking keywords related to popular cryptocurrency services and remote access tools.

While only one incident resulted in the deployment of Crazy ransomware, Huntress suspects that the same threat actor is responsible for both incidents due to overlapping infrastructure and filenames used in the attacks.

This trend of using legitimate remote management tools in ransomware attacks is becoming increasingly common, allowing attackers to blend in with legitimate network traffic. Organizations are advised to monitor for unauthorized installations of such tools and enforce multi-factor authentication (MFA) on all remote access services.

Implications for Organizations

The use of legitimate tools by attackers underscores the need for organizations to enhance their security measures. Monitoring for unauthorized installations and enforcing MFA can significantly reduce the risk of such intrusions.