VoidMalware

“Upon connecting via Remote Desktop Protocol to a domain controller, the threat actor launched an interactive PowerShell session to begin staging their tooling.”

“…ing the msiexec command used to silently install the Net Monitor for Employees Professional agent with reverse connection and process masquerading parameters.”

“At the end of January 2026, Huntress observed a signal alerting us to activity that we’ve seen multiple times - suspicious account manipulation on a host.”

“…ts: Ensure default accounts like Guest and Administrator are disabled or renamed where possible to reduce the surface area for common brute-force attacks.”

“… SimpleHelp agent logs showing keyword-based monitoring triggers for cryptocurrency wallets, exchanges, blockchain explorers, and remote access tools via GlobalEvents”

“The Windows service was registered under the name OneDriveSvc with a service process name of OneDriver.exe, mimicking Microsoft's OneDrive service.”