VENOMOUS#HELPER: How Phishers Are Using Trusted RMM

VENOMOUS#HELPER: How Phishers Are Using Trusted RMM Tools to Compromise 80+ Organizations

An active phishing campaign codenamed VENOMOUS#HELPER has been targeting organizations worldwide since April 2025, using legitimate Remote Monitoring and Management (RMM) tools to establish persistent, undetectable access to compromised systems. The campaign has impacted over 80 organizations across multiple countries, with the majority of victims located in the United States, representing a sophisticated evolution in attack techniques that abuse trusted software instead of deploying traditional malware.

This dual-RMM approach leverages signed, vendor-distributed SimpleHelp and ScreenConnect binaries to bypass security controls, using what appears to be legitimate IT management software as a delivery mechanism for remote access. The attack chain begins with Social Security Administration impersonation phishing and culminates in deeply entrenched remote access that survives traditional endpoint security measures and even Safe Mode reboots.

Campaign Overview: VENOMOUS#HELPER (STAC6405)

The VENOMOUS#HELPER campaign, tracked by security researchers as STAC6405, represents a significant shift in attacker methodology. Instead of developing custom malware or exploiting known vulnerabilities, threat actors are weaponizing legitimate IT management tools that organizations already trust and use daily. This approach provides several advantages for attackers:

• Evades signature-based detection – Uses legitimately signed binaries from trusted vendors
• Bypasses application whitelisting – Leverages software that’s already approved for enterprise use
• Provides persistent access – Uses built-in persistence mechanisms of the RMM tools
• Maintains plausible deniability – Activity appears to be legitimate IT administration

As of May 2026, the campaign remains active with some phishing infrastructure still operational. Sophos, Securonix, Red Canary, and The Hacker News have all confirmed the ongoing nature of this threat, with researchers observing consistent TTPs (Tactics, Techniques, and Procedures) across different victim organizations. Sophos tracks this activity as STAC6405, while Red Canary has observed similar patterns in their threat intelligence collection.

Technical Mechanism: From Phishing to Persistent Access

The attack chain employs a multi-stage delivery process that begins with social engineering and culminates in deeply entrenched remote access. Each stage is carefully designed to maximize the chances of successful infection while minimizing detection opportunities.

Stage 1: Phishing Delivery – Government Impersonation

The campaign initiates with highly convincing U.S. Social Security Administration (SSA) impersonation phishing emails. Unlike typical phishing attempts that use suspicious domains, this campaign leverages compromised legitimate business domains to bypass secure email gateway filtering. The phishing emails direct victims to government-themed verification pages that collect email addresses before providing access to supposedly sensitive documents.

The delivery chain uses a sophisticated two-stage hosting approach:

1. Frontend domain: gruta[.]com.mx – A compromised legitimate Mexican business website serving phishing content
2. Payload host: server.cubatiendaalimentos[.]com[.]mx/~tiendazoycom/sns/ – A legitimate Mexican e-commerce site with a compromised shared hosting account

Stage 2: Lure Execution – JWrapper and Social Engineering

The phishing lure is delivered as a JWrapper-packaged Windows executable (e.g., statement5648.exe, ContractAgreementToSign.exe). The executable is carefully crafted to exploit Windows User Account Control (UAC) behaviors:

• File extensions are hidden by default in Windows Explorer, making “statement5648.exe” appear as “statement5648”
• JWrapper embeds legitimate-looking application icons and splash images
• The UAC prompt displays “Verified publisher: SimpleHelp Ltd” with a blue shield icon
• The valid Thawte Authenticode certificate produces the trusted publisher warning rather than the “Unknown Publisher” warning

This social engineering combination creates a high probability of user approval, as victims believe they’re opening a legitimate government document from a trusted vendor.

Stage 3: Service Installation – Persistent Windows Service

Once executed, the malware establishes persistent Windows service installation through multiple mechanisms:

• Standard service registration – Creates a Windows service via the Service Control Manager (SCM)
• Safe Mode persistence – Writes to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Remote Access Service
• Self-healing watchdog – Monitors an alive file and automatically restarts the service if terminated

Stage 4: Session Escalation – Interactive Desktop Access

The RMM service operates in Session 0 (SYSTEM context) but requires interactive access to the victim’s desktop. This is achieved through a sophisticated token manipulation process:

1. session_win.exe acquires SeDebugPrivilege and clones tokens from winlogon.exe
2. elev_win.exe provides UAC elevation via ShellExecuteEx with ‘runas’ verb
3. The result is fully interactive desktop control – screen reading, keystroke injection, and file access

Stage 5: Dual-RMM Architecture – Redundant Access Channels

The campaign’s most distinctive feature is the deployment of two independent RMM tools simultaneously, creating a resilient architecture:

Affected Systems and Industries

The VENOMOUS#HELPER campaign has demonstrated broad targeting across multiple sectors and geographies. Understanding the scope of affected organizations helps contextualize the threat landscape and prioritize defensive measures.

Geographic Distribution

The campaign has primarily targeted organizations in:

• United States – 92% of victims, across multiple industry sectors
• Western Europe – Including Germany, France, and the UK
• Latin America – Including Mexico, Brazil, and Argentina
• Other regions – Including Canada, Australia, and parts of Asia

Industry Impact

The phishing emails and lures are distributed across multiple sectors, with particular focus on:

• Healthcare and Life Sciences – 19% of targets
• Financial Services – 18% of targets
• Professional Services – 11% of targets
• Technology and Software – 11% of targets
• Government and Public Sector – Significant targeting observed

Victim Characteristics

Organizations affected by this campaign typically exhibit several characteristics that make them attractive targets:

• Users with administrative privileges or RMM installation permissions
• Organizations using remote work solutions and BYOD policies
• Companies with insufficient application control policies
• Organizations lacking behavioral analytics capabilities

Attack Capabilities and Impact

Once established on a victim system, the VENOMOUS#HELPER infrastructure provides attackers with comprehensive capabilities for surveillance, data theft, and lateral movement. The impact extends beyond initial compromise to potentially include data breach, ransomware deployment, and long-term espionage.

SimpleHelp Capability Profile

The deployed SimpleHelp version (5.0.1) provides extensive remote administration capabilities:

• Full Remote Desktop – VNC-based interactive control with screen capture, keyboard/mouse injection, and clipboard access
• Command Execution – Scripted command execution via winpty-agent64.exe pseudo-terminal bridge
• Silent Session Access – No victim notification required (RequireSessionConfirmation=false)
• Cross-Session Process Injection – Execution in user’s desktop session from SYSTEM context
• UAC Elevation – Silent privilege escalation via ShellExecuteEx ‘runas’ verb
• Bidirectional File Transfer – Full upload/download capabilities
• Windows Firewall Bypass – Automatically adds firewall exceptions
• Scripting and Automation – PowerShell, cmd, and other script execution
• Self-Healing – Automatic service restart and re-registration

Automated Surveillance Loop

The deployed RAT maintains continuous automated surveillance through three concurrent polling loops:

EDR Evasion Techniques

The campaign employs sophisticated evasion techniques to bypass modern endpoint security:

• wmic.exe.bak – Renames legitimate wmic.exe to bypass name-based detection rules
• Process lineage obfuscation – Uses signed binaries as process parents
• Network protocol camouflage – Uses UDP/HTTP protocols common to legitimate RMM tools
• Behavioral mimicry – Polling intervals and execution patterns resemble legitimate IT management

Detection Indicators and Alerting

Detecting VENOMOUS#HELPER infection requires moving beyond traditional signature-based detection and focusing on behavioral anomalies and process lineage. The campaign’s use of legitimate software makes it particularly challenging to detect through conventional means.

Key Detection Indicators

Security teams should focus on the following high-confidence indicators:

File System Indicators

• JWrapper binaries in non-standard locations (C:\ProgramData\JWrapper-Remote Access\)
• SimpleHelp 5.0.1 with expired certificate validity (2015-2018)
• Renamed wmic.exe.bak in C:\Windows\System32\wbem\
• Service configuration files with hardcoded C2 IPs

Process Activity Indicators

• SimpleHelp service installation from user Downloads directory
• Session boundary crossing (Session 0 to Session 1)
• Continuous polling behavior (every 15-67 seconds)
• Parent-child relationships showing unusual process hierarchies

Network Activity Indicators

• Outbound connections to 84.200.205[.]233:5555 (UDP)
• Connections to sslzeromail[.]run.place:8041
• TCP traffic to known RMM infrastructure
• Unusual protocol usage from legitimate software binaries

SIEM Detection Queries

Organizations can implement the following detection queries to identify VENOMOUS#HELPER activity:

Process Anomaly Detection

SELECT process.name, process.parent_name, process.cmdline, process.path
FROM endpoint_events
WHERE process.name IN ('SimpleGatewayService.exe', 'Remote Access.exe', 'elev_win.exe')
AND process.path NOT LIKE '%Program Files%'
AND process.path NOT LIKE '%Program Files (x86)%'
AND timestamp > now() - 7d

Network Connection Monitoring

SELECT src_ip, dst_ip, dst_port, process.name
FROM network_events
WHERE dst_ip IN ('84.200.205.233', '213.136.71.246')
AND dst_port IN (5555, 8041)
AND process.name IN ('SimpleGatewayService.exe', 'Remote Access.exe')
AND timestamp > now() - 7d

Registry Modification Detection

SELECT registry_key, registry_value, process.name
FROM registry_events
WHERE registry_key LIKE 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network%'
AND registry_value = 'Remote Access Service'
AND timestamp > now() - 7d

Mitigation Strategies and Prevention

Preventing VENOMOUS#HELPER infections requires a multi-layered approach that combines technical controls, administrative policies, and user awareness. The campaign’s reliance on legitimate software makes traditional prevention methods less effective, necessitating more sophisticated security strategies.

Preventive Controls

Application Control and Software Restriction

• Implement application control policies to block unauthorized RMM tools
• Require approval for RMM installations and maintain an approved software list
• Block executable downloads from email attachments and web browsers
• Use application whitelisting to allow only approved software to execute

Network Security Measures

• Block known malicious infrastructure – 84.200.205[.]233, sslzeromail[.]run.place
• Monitor unusual outbound connections from workstations to known RMM endpoints
• Implement network segmentation to limit lateral movement potential
• Use DNS filtering to block access to suspicious domains

Email Security Hardening

• Implement advanced email authentication – DMARC, SPF, DKIM
• Use sandbox analysis for attachments and URLs
• Block government impersonation themes in phishing detection
• Enable attachment behavior analysis for JWrapper executables

Immediate Response Actions

If VENOMOUS#HELPER infection is suspected, organizations should take the following immediate actions:

Containment

1. Isolate affected systems from the network to prevent lateral movement
2. Preserve evidence – Memory captures, process listings, network logs
3. Document infection timeline and initial compromise vector
4. Notify incident response team and relevant stakeholders

Remediation

1. Terminate malicious services and remove registry entries
2. Delete JWrapper binaries and associated configuration files
3. Remove renamed wmic.exe.bak and restore legitimate wmic.exe
4. Uninstall unauthorized RMM software
5. Reset credentials for any potentially compromised accounts
6. Conduct forensic analysis to determine full compromise scope

Long-Term Security Improvements

To prevent future VENOMOUS#HELPER-style attacks, organizations should implement the following long-term security improvements:

• Implement behavioral analytics to detect anomalous process behavior
• Deploy endpoint detection and response solutions with behavioral analysis
• Regular security awareness training focusing on phishing recognition
• Implement zero-trust network architecture
• Regular security audits of RMM usage and permissions

Detection and Response Checklist

Organizations should maintain the following checklist for detecting and responding to VENOMOUS#HELPER infections:

Prevention Checklist

• [ ] Implement application control policies for RMM tools
• [ ] Require approval for all software installations
• [ ] Block JWrapper executable downloads
• [ ] Configure advanced email filtering with sandbox analysis
• [ ] Implement network segmentation
• [ ] Regular security awareness training

Detection Checklist

• [ ] Monitor for JWrapper binaries in non-standard locations
• [ ] Alert on SimpleHelp services from unexpected paths
• [ ] Detect renamed wmic.exe.bak files
• [ ] Monitor connections to known C2 infrastructure
• [ ] Alert on continuous polling behavior
• [ ] Review SafeBoot registry modifications

Response Checklist

• [ ] Isolate affected systems immediately
• [ ] Preserve evidence for forensic analysis
• [ ] Document infection timeline and scope
• [ ] Remove malicious services and registry entries
• [ ] Delete JWrapper binaries and configurations
• [ ] Uninstall unauthorized RMM software
• [ ] Reset compromised credentials
• [ ] Conduct post-incident review and update defenses

Frequently Asked Questions

Q1: How does VENOMOUS#HELPER bypass traditional antivirus and EDR solutions?

A1: The campaign bypasses traditional security controls by using legitimately signed RMM software from trusted vendors. The SimpleHelp and ScreenConnect binaries carry valid Authenticode signatures from Thawte and ConnectWise respectively, which means they pass signature-based detection. Additionally, the attack employs sophisticated behavioral evasion techniques like renamed system binaries (wmic.exe.bak), process lineage obfuscation, and network protocol camouflage that make detection through traditional methods challenging.

Q2: What makes this campaign different from other RMM-based attacks?

A2: VENOMOUS#HELPER is distinguished by its dual-RMM architecture, where two separate legitimate RMM tools are deployed simultaneously. This creates a redundant access channel that ensures persistence even if one tool is detected and removed. The campaign also demonstrates a higher level of sophistication in terms of social engineering, using government impersonation with compromised legitimate domains, and includes advanced persistence mechanisms like SafeBoot registry modifications and self-healing watchdog processes.

Q3: How can organizations determine if they’ve been compromised by this campaign?

A3: Organizations should look for several key indicators: JWrapper binaries in non-standard locations (C:\ProgramData\JWrapper-Remote Access\), SimpleHelp 5.0.1 with expired certificates, renamed wmic.exe.bak files in system directories, Windows services with hardcoded C2 IPs, and continuous polling behavior every 15-67 seconds. Network monitoring should look for connections to 84.200.205[.]233:5555 and 213.136.71.246:8041. Behavioral analytics can detect anomalous process patterns like the automated surveillance loop.

Q4: Why do attackers use both SimpleHelp and ScreenConnect simultaneously?

A4: The dual-RMM approach provides strategic redundancy and operational flexibility. SimpleHelp handles automated surveillance, scripted command execution, and file transfers, while ScreenConnect provides interactive desktop access. This architecture ensures persistence through partial remediation – if one tool is detected and blocked, the other remains operational. The redundancy also allows attackers to experiment with different access methods and maintain connectivity even if network conditions change or one communication channel is disrupted.

Q5: What are the most effective defense measures against this type of attack?

A5: The most effective defense measures are multi-layered: application control and whitelisting to prevent unauthorized RMM installations, behavioral analytics to detect anomalous process patterns and automated surveillance, network segmentation to limit lateral movement, advanced email security with sandbox analysis, and regular security awareness training. Organizations should also implement strict change management for software installations and monitor for unusual process lineage and network connections that deviate from established baselines.

References and Additional Resources

• The Hacker News – “Phishing Campaign Hits 80+ Orgs Using SimpleHelp and ScreenConnect RMM Tools” – https://thehackernews.com/2026/05/phishing-campaign-hits-80-orgs-using.html
• Securonix – “VENOMOUS#HELPER: Dual-RMM Phishing Campaign Leveraging JWrapper-Packaged SimpleHelp and ScreenConnect for Silent Remote Access” – https://www.securonix.com/blog/venomous-helper-phishing-campaign
• Red Canary – “Threat intelligence: Phishing with RMM tools” – https://redcanary.com/blog/threat-intelligence/phishing-rmm-tools/
• CISA KEV Catalog – CVE-2024-57726 (SimpleHelp Missing Authorization) and CVE-2024-57728 (SimpleHelp Path Traversal) – https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Mitre ATT&CK – Enterprise ATT&CK matrix for related techniques – https://attack.mitre.org/