Ransomware operators abuse legitimate remote administration tools and exploit SmarterMail flaws for initial access and persistence

Ransomware activity is increasingly blending into normal IT operations by combining exploitation of internet-facing software with the use of legitimate remote access and monitoring tools. Huntress reported multiple intrusions tied to the Crazy ransomware gang where attackers deployed Net Monitor for Employees Professional and the SimpleHelp remote support client to maintain persistence, evade detection, and stage for ransomware deployment. The actors installed the monitoring agent via msiexec.exe directly from the vendor site, then used it for interactive control (desktop viewing, file transfer, command execution); they also added redundant access by installing SimpleHelp via PowerShell and disguising binaries with benign-looking names (e.g., vshost.exe) and paths such as C:\ProgramData\OneDriveSvc\OneDriveSvc.exe.

In parallel, ransomware groups have been observed actively exploiting recently patched SmarterTools SmarterMail vulnerabilities that enable unauthenticated compromise of mail servers. SC Media reported that CISA added CVE-2026-24423 to the KEV catalog after it was linked to ransomware campaigns; the flaw enables unauthenticated RCE via SmarterMail’s ConnectToHub API by delivering a malicious OS command from a remote server. A second issue, CVE-2026-23760, allows authentication bypass through the password reset API (force-reset-password) by not validating the old password; ReliaQuest attributed active exploitation of this weakness to a China-based actor tracked as Storm-2603, which reportedly chained the bypass with SmarterMail’s Volume Mount feature to reach RCE, activity assessed as staging consistent with Warlock ransomware operations (even when ransomware was not yet deployed).