Over 80 Organisations Impacted by Phishing Leveraging SimpleHelp and ScreenConnect

Researchers have identified a systematic intrusion operation that is utilizing remote management utilities, and recent findings reinforce this shift in phishing campaigns, which have evolved from opportunistic scams to structured intrusion operations. 

Researchers have identified an ongoing campaign that has compromised more than 80 organizations across multiple industries since April 2025, with a significant concentration in the United States.
In the operation, malicious software is deliberately used, allowing attackers to establish covert and persistent access under the guise of legitimate administrative activity through the deliberate use of vendor-signed Remote Monitoring and Management software. 

Through the deployment of modified versions of SimpleHelp and ScreenConnect, the threat actors have effectively bypassed conventional security controls, relying on trusted installation workflows initiated by innocent individuals. 

The activity aligns with previously observed clusters tracked by independent security teams, but this latest analysis provides enhanced insight into the campaign’s indicators, behavior, and operational sophistication, highlighting a coordinated effort that is extending its reach in a coordinated fashion. 

Securonix analysis, which tracks the VENOMOUS#HELPER activity cluster, shows that the operation has maintained continuous momentum since April 2025, extending its reach beyond the U.S. into Western Europe and Latin America. 

The campaign is distinguished by its calculated use of two Remote Monitoring and Management platforms, SimpleHelp and ScreenConnect both of which are legitimately signed and widely utilized by enterprises. Rather than deploying conventional malware payloads, threat actors employ these trusted tools to embed persistent access within victim systems, effectively blending malicious activity with routine administrative functions in order to achieve effective results. 

By using two RMM solutions in parallel, there is built-in redundancy, which ensures access continues regardless of whether a channel is detected and removed. Although no formal attribution has been established, Securonix concludes that these operational patterns are consistent with financial motivated Initial Access Brokers and early-stage ransomware campaigns, particularly those targeting organizations in economically significant regions. 

The activity cluster, known as VENOMOUS#HELPER, continues to demonstrate significant overlap with threat patterns previously documented by Red Canary and Sophos, whose designation for it is STAC6405, based on these findings. Although its operational characteristics are consistent with financial-driven initial access brokerage or early-stage ransomware enablement, its attribution remains unclear. 

A researcher involved in the investigation indicates that by deploying SimpleHelp and ScreenConnect in customized configurations, the campaign is able to circumvent conventional defensive mechanisms by embedding itself within legitimate administrative workflows, which allows attackers to bypass conventional defensive mechanisms. 

Additionally, a deliberate dual-channel access strategy is used to strengthen the resilience and continuity of control, even if one access vector is identified and neutralised.
The intrusion sequence

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.