Loading malware…
10 distinct techniques documented for this family, organized by ATT&CK tactic.
"launched an interactive PowerShell session to begin staging their tooling"; "terminal pulling down a file via PowerShell"
"installed ... agent by executing an msiexec command that pulled the installer directly from ... networklookout[.]com"
"suspicious account manipulation... disable the system Guest account"; "user enumeration, attempting to reset passwords and create additional user accounts... enabling the built-in Administrator account"
"The attacker disguised the Net Monitor agent... registering the service as OneDriveSvc"; "installed SimpleHelp as a service named Remote Access Service"
"suspicious account manipulation... disable the system Guest account"; "user enumeration, attempting to reset passwords and create additional user accounts... enabling the built-in Administrator account"
"The attacker disguised the Net Monitor agent... registering the service as OneDriveSvc"; "installed SimpleHelp as a service named Remote Access Service"
They also used a built-in configuration parameter to register the Net Monitor on the Windows desktop as OneDriveSvbc with a process name of OneDriver.exe - obviously an attempt to hide the presence of the remote monitoring and management software by disguising it as a Windows service. They then renamed the running process to svchost.exe, "a ubiquitous Windows system process."
Hackers used it to download SimpleHelp, from which they made commands including attempting to tamper with Windows Defender.
"executed ping commands to probe internal network segments, as well as ipconfig /all"
"installed ... agent by executing an msiexec command that pulled the installer directly from ... networklookout[.]com"
They configured Net Monitor to call back to a command-and-control website through port 443, the same server port at HTTPS and one that firewalls are configured to let through.
"reverse connection ... on port 443"; "operate over common ports"; "connect to ... gateways"
Threat intel published by the firm Wednesday detailed two early 2026 incidents in which hackers used Net Monitor for Employees Professional and SimpleHelp for nefarious ends - in one case attempting to deploy "Crazy" ransomware, a variant belonging to the VoidCrypt ransomware family.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.