SimpleHelp

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Network edge devices and other internet-facing systems remain the front door to victim networks for these groups. Fortinet, Ivanti, SonicWall, SimpleHelp, Microsoft SharePoint, SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack all appear across these three profiles.

SimpleHelp ... is often used in phishing campaigns involving “invitation” lures in which the victim is encouraged to download and execute an invite to a party (e.g. Ecard9140.exe ).

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1566.001 Phishing: Spearphishing Attachment U.S. SSA government impersonation email with link to compromised [.]com.mx frontend

MuddyWater began using "fully signed" and legitimate RMM tools as part of its attack chain in 2020, often by including links in phishing emails designed to trick victims into downloading and executing RMM installers.

SimpleHelp is the primary RMM channel, which the threat actor is using to run scripts and commands, execute automated tasks...

multiple ransomware groups, including initial access brokers with ties to Play ransomware operators, are also exploiting three vulnerabilities - CVE-2024-57727 - in remote monitoring and management tool SimpleHelp to conduct remote code execution

C:\Windows\Temp\mesch.exe run ... C:\Windows\Temp\mesch.exe b64exec ... C:\Windows\Temp\mesch.exe -fullinstall

In reality the file is a malicious executable that initiates a sequence of actions leading to the installation of the SimpleHelp and ScreenConnect RMM tools on their system.

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1543.003 Create or Modify System Process: Windows Service Remote Access Service installed via SCM

the malware installs itself as a Windows service with Safe Mode persistence, makes sure it's running by means of a "self-healing watchdog" that automatically restarts it when killed

To facilitate fully interactive desktop access, the SimpleHelp remote access client acquires SeDebugPrivilege via AdjustTokenPrivileges, while "elev_win.exe" – a legitimate executable file associated with the software – is used to gain SYSTEM-level privileges.

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1134.001 Access Token Manipulation: Token Impersonation winlogon.exe token theft via session_win.exe

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1134.002 Access Token Manipulation: Create Process with Token CreateProcessAsUserW with stolen token

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1543.003 Create or Modify System Process: Windows Service Remote Access Service installed via SCM

the malware installs itself as a Windows service with Safe Mode persistence, makes sure it's running by means of a "self-healing watchdog" that automatically restarts it when killed

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1548.002 Abuse Elevation Control Mechanism: Bypass UAC elev_win.exe –runas via ShellExecuteEx

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1027 Obfuscated Files or Information Hex-encoded C2 config in JWrapper launch properties

Even when the file is renamed to something like party_invite.exe , or Voicemailaudioext.exe ... A common lure is themed as a Social Security statement ( ssa.msi ) ... using lures such as a document ( docmentfilecsm_jw98evavuqm5gb3.exe ) or an IRS tax-related file ( IRS-Statement_Pr2ui4J9cfA6YEu.exe ).

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1036.003 Masquerading: Rename System Utilities wmic.exe renamed to wmic.exe.bak

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1134.001 Access Token Manipulation: Token Impersonation winlogon.exe token theft via session_win.exe

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1134.002 Access Token Manipulation: Create Process with Token CreateProcessAsUserW with stolen token

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1497.001 Virtualization/Sandbox Evasion: System Checks Mouse position polling for user presence detection

MITRE ATT&CK Mapping Tactic Technique ID Implementation Resource Development Obtain Capabilities: Tool T1588.002 Legitimate SimpleHelp + ScreenConnect licenses Resource Development Acquire Infrastructure: VPS T1583.003 Fresh /24 subnet on bulletproof hosting Initial Access Phishing T1566 Signed RAT distributed to victims Execution User Execution: Malicious File T1204.002 Legitimately signed binary Persistence Create or Modify System Process: Windows Service T1543.003 Remote Access Service Defense Evasion Subvert Trust Controls: Code Signing T1553.002 Valid DigiCert certificate

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1016 System Network Configuration Discovery netsh wlan show interfaces every 15 seconds

...including checks on network connectivity, user activity, and installed security tools.

They directed the SimpleHelp agent to search the desktop for cryptocurrency-related keywords, as well as keywords associated with remote access, "likely to detect if anyone was actively connecting to the machine."

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1497.001 Virtualization/Sandbox Evasion: System Checks Mouse position polling for user presence detection

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1518.001 Software Discovery: Security Software Discovery SecurityCenter2 WMI queries every 67 seconds

Over the last few years, threat actors have flocked to exploit legitimate remote monitoring and management (RMM) tools—blue-chip IT software like ScreenConnect, LogMeIn Resolve, and PDQ Connect—blurring the line between legitimate IT administration and malicious intrusion.

File IOCs ... AnyDesk.exe ... SimpleService.exe ... elev_win.exe ... KslD.sys ... winupdate.exe (Restic)

On one host, Huntress observed a threat actor installing a malicious AnyDesk RMM instance post-exploitation... On some hosts, the threat actor was observed deploying MeshAgent... On April 7, a threat actor was observed... to install the SimpleHelp RMM on a host as a persistence mechanism.

Hackers used it to download SimpleHelp, from which they made commands including attempting to tamper with Windows Defender.

When mx.exe was uploaded, Defender initially quarantined the executable. The threat actor then made multiple attempts to add to the Defender exclusions list for the directory... Add-MpPreference -ExclusionPath "c:\windows"

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1562.009 Impair Defenses: Safe Mode Boot SafeBoot\Network registry key for Safe Mode persistence