The DragonForce ransomware operation successfully breached a managed service provider and used its SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy encryptors on downstream customers' systems.
DragonForce ransomware abuses MSP’s SimpleHelp RMM to encrypt customers
The DragonForce ransomware operation successfully breached a managed service provider and used its SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy encryptors on downstream customers' systems.
www.bleepingcomputer.com
May 27, 2025 at 9:44 PM
The DragonForce ransomware operation successfully breached a managed service provider and used its SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy encryptors on downstream customers' systems.
Hackers are believed to be exploiting recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks. #networkbreach #hackingnews #CyberSecurity
www.bleepingcomputer.com/news/securit...
www.bleepingcomputer.com/news/securit...
Hackers exploiting flaws in SimpleHelp RMM to breach networks
Hackers are believed to be exploiting recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks.
www.bleepingcomputer.com
January 28, 2025 at 10:02 PM
Hackers are believed to be exploiting recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks. #networkbreach #hackingnews #CyberSecurity
www.bleepingcomputer.com/news/securit...
www.bleepingcomputer.com/news/securit...
Hackers are believed to be exploiting recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks.
Hackers exploiting flaws in SimpleHelp RMM to breach networks
Hackers are believed to be exploiting recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks.
www.bleepingcomputer.com
January 28, 2025 at 9:49 PM
Hackers are believed to be exploiting recently fixed SimpleHelp Remote Monitoring and Management (RMM) software vulnerabilities to gain initial access to target networks.
Explotan una vulnerabilidad crítica en SimpleHelp para desplegar nuevo malware de robo de datos
#Ciberseguridad #Seguridad #Tecnología #LaiaDesk
#Ciberseguridad #Seguridad #Tecnología #LaiaDesk
Explotan una vulnerabilidad crítica en SimpleHelp para desplegar nuevo malware de robo de datos
Una vulnerabilidad crítica en SimpleHelp, una plataforma de gestión remota (RMM) muy utilizada por proveedores de servicios gestionados (MSP), departamentos de TI y equipos de sopo…
laiadesk.com
September 23, 2026 at 6:20 AM
Explotan una vulnerabilidad crítica en SimpleHelp para desplegar nuevo malware de robo de datos
#Ciberseguridad #Seguridad #Tecnología #LaiaDesk
#Ciberseguridad #Seguridad #Tecnología #LaiaDesk
IABs now weaponize signed RMM tools (ConnectWise, GoTo, Datto) as a foothold - then hand off to a second RAT. https://intel.threadlinqs.com/threat/TL-2026-2645 #ThreatIntel #ConnectWise #SimpleHelp #NAble
September 25, 2026 at 4:31 AM
IABs now weaponize signed RMM tools (ConnectWise, GoTo, Datto) as a foothold - then hand off to a second RAT. https://intel.threadlinqs.com/threat/TL-2026-2645 #ThreatIntel #ConnectWise #SimpleHelp #NAble
Hackers Exploiting SimpleHelp RMM Flaws for Persistent Access and Ransomware
Hackers Exploiting SimpleHelp RMM Flaws for Persistent Access and Ransomware
thehackernews.com
February 7, 2025 at 5:51 AM
Hackers Exploiting SimpleHelp RMM Flaws for Persistent Access and Ransomware
🚨 SimpleHelp flaw already fuels real intrusions
Attackers are actively exploiting an authentication bypass in #SimpleHelp remote support software, prompting urgent patching for exposed servers.
🔗 read more: securityonline.info/simplehelp-a...
#ransomNews #cybersecurity
Attackers are actively exploiting an authentication bypass in #SimpleHelp remote support software, prompting urgent patching for exposed servers.
🔗 read more: securityonline.info/simplehelp-a...
#ransomNews #cybersecurity
June 30, 2026 at 9:37 AM
🚨 SimpleHelp flaw already fuels real intrusions
Attackers are actively exploiting an authentication bypass in #SimpleHelp remote support software, prompting urgent patching for exposed servers.
🔗 read more: securityonline.info/simplehelp-a...
#ransomNews #cybersecurity
Attackers are actively exploiting an authentication bypass in #SimpleHelp remote support software, prompting urgent patching for exposed servers.
🔗 read more: securityonline.info/simplehelp-a...
#ransomNews #cybersecurity
Several people I know received emails that are "invitations" to events that don't exist. They are actually attackers trying to get more victims to install the SimpleHelp software on their computers.
I wrote a removal guide. webbreacher.com/2026/03/09/s...
#SimpleHelpAttack
I wrote a removal guide. webbreacher.com/2026/03/09/s...
#SimpleHelpAttack
SimpleHelp Attack Remediation Steps - Micah's personal blog.
Hi all. This is a simple help page to assist people that have had their Windows computer’s compromised by an attacker that uses the SimpleHelp software for remote control. To infect your computer, the...
webbreacher.com
March 10, 2026 at 1:20 AM
Several people I know received emails that are "invitations" to events that don't exist. They are actually attackers trying to get more victims to install the SimpleHelp software on their computers.
I wrote a removal guide. webbreacher.com/2026/03/09/s...
#SimpleHelpAttack
I wrote a removal guide. webbreacher.com/2026/03/09/s...
#SimpleHelpAttack
Ransomware gangs are exploiting unpatched SimpleHelp flaws to hit utility billing customers with double extortion attacks — since Jan 2025.
CISA warns: patch now or risk serious breaches.
#RansomwareAttacks #CyberSecurity
thehackernews.com/2025/06/rans...
CISA warns: patch now or risk serious breaches.
#RansomwareAttacks #CyberSecurity
thehackernews.com/2025/06/rans...
Ransomware Gangs Exploit Unpatched SimpleHelp Flaws to Target Victims with Double Extortion
CISA warns ransomware groups exploiting unpatched SimpleHelp RMM to breach organizations worldwide, risking data theft and double extortion
thehackernews.com
June 13, 2025 at 9:30 PM
Ransomware gangs are exploiting unpatched SimpleHelp flaws to hit utility billing customers with double extortion attacks — since Jan 2025.
CISA warns: patch now or risk serious breaches.
#RansomwareAttacks #CyberSecurity
thehackernews.com/2025/06/rans...
CISA warns: patch now or risk serious breaches.
#RansomwareAttacks #CyberSecurity
thehackernews.com/2025/06/rans...
Ransomware scum disrupted utility services with SimpleHelp attacks
Ransomware scum disrupted utility services with SimpleHelp attacks
Good news: The vendor patched the flaw in January. Bad news: Not everyone got the memo
Ransomware criminals infected a utility billing software providers' customers, and in some cases disrupted services, after exploiting unpatched versions of SimpleHelp’s remote monitoring and management (RMM) tool, according to a Thursday CISA alert.…
dlvr.it
June 12, 2025 at 11:58 PM
Ransomware scum disrupted utility services with SimpleHelp attacks
It feels like CISA is a little behind with this reporting...I hope this isn't a sign of what we are going see going forward.
CISA warns of SimpleHelp ransomware compromises after string of retail attacks
via @jgreig.bsky.social & @therecordmedia.bsky.social
CISA warns of SimpleHelp ransomware compromises after string of retail attacks
via @jgreig.bsky.social & @therecordmedia.bsky.social
CISA warns of SimpleHelp ransomware compromises after string of retail attacks
Ransomware gangs leveraged a vulnerability to access unpatched versions of SimpleHelp's remote monitoring and management tool to disrupt services in double extortion compromises.
therecord.media
June 16, 2025 at 1:30 PM
It feels like CISA is a little behind with this reporting...I hope this isn't a sign of what we are going see going forward.
CISA warns of SimpleHelp ransomware compromises after string of retail attacks
via @jgreig.bsky.social & @therecordmedia.bsky.social
CISA warns of SimpleHelp ransomware compromises after string of retail attacks
via @jgreig.bsky.social & @therecordmedia.bsky.social
Hackers are targeting vulnerable SimpleHelp RMM clients to create administrator accounts, drop backdoors, and potentially lay the groundwork for ransomware attacks.
SimpleHelp RMM flaws exploited to breach corporate networks
Hackers are targeting vulnerable SimpleHelp RMM clients to create administrator accounts, drop backdoors, and potentially lay the groundwork for ransomware attacks.
www.bleepingcomputer.com
February 6, 2025 at 5:51 PM
Hackers are targeting vulnerable SimpleHelp RMM clients to create administrator accounts, drop backdoors, and potentially lay the groundwork for ransomware attacks.
Bugs in remote support tools that grant remote access to customer devices are bad... I've been told. Could be wrong too!
www.tenable.com/blog/tenable...
www.tenable.com/blog/tenable...
Tenable Discovers Critical Vulnerabilities in SimpleHelp Tool: CVE-2025-36727 and CVE-2025-36728
Tenable Research found two flaws in SimpleHelp’s remote-support tool that can be chained together to gain remote code execution on clients' devices. SimpleHelp has patched them: CVE-2025-36728 in vers...
www.tenable.com
October 19, 2025 at 4:34 PM
Bugs in remote support tools that grant remote access to customer devices are bad... I've been told. Could be wrong too!
www.tenable.com/blog/tenable...
www.tenable.com/blog/tenable...
-CryLock couple profile
-Zendesk email bomb attacks
-20 ASNs responsible for most brute-force badness
-Lumma operators get doxxed
-APT35 linked to Shuhada base in Tehran
-AMD RDSEED vulnerability
-Dolby 0-click vuln
-ConnectWise security update
-SimpleHelp RCE
-Companies are getting deputy CISOs
-Zendesk email bomb attacks
-20 ASNs responsible for most brute-force badness
-Lumma operators get doxxed
-APT35 linked to Shuhada base in Tehran
-AMD RDSEED vulnerability
-Dolby 0-click vuln
-ConnectWise security update
-SimpleHelp RCE
-Companies are getting deputy CISOs
October 20, 2025 at 7:54 AM
-CryLock couple profile
-Zendesk email bomb attacks
-20 ASNs responsible for most brute-force badness
-Lumma operators get doxxed
-APT35 linked to Shuhada base in Tehran
-AMD RDSEED vulnerability
-Dolby 0-click vuln
-ConnectWise security update
-SimpleHelp RCE
-Companies are getting deputy CISOs
-Zendesk email bomb attacks
-20 ASNs responsible for most brute-force badness
-Lumma operators get doxxed
-APT35 linked to Shuhada base in Tehran
-AMD RDSEED vulnerability
-Dolby 0-click vuln
-ConnectWise security update
-SimpleHelp RCE
-Companies are getting deputy CISOs
A vulnerability in the SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using the OpenID Connect (OIDC) authentication protocol.
SimpleHelp bug lets hackers create rogue remote support accounts
A vulnerability in the SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using the OpenID Connect (OIDC) authentication protocol.
www.bleepingcomputer.com
June 15, 2026 at 8:07 PM
A vulnerability in the SimpleHelp remote management software allows unauthenticated attackers to create privileged technician accounts on servers using the OpenID Connect (OIDC) authentication protocol.
~Cisa~
Ransomware actors are exploiting CVE-2024-57727 in unpatched SimpleHelp RMM to compromise downstream customers.
-
IOCs: CVE-2024-57727
-
#CVE202457727 #Ransomware #SimpleHelp #ThreatIntel
Ransomware actors are exploiting CVE-2024-57727 in unpatched SimpleHelp RMM to compromise downstream customers.
-
IOCs: CVE-2024-57727
-
#CVE202457727 #Ransomware #SimpleHelp #ThreatIntel
CISA Alert: SimpleHelp RMM Exploited
www.cisa.gov
June 12, 2025 at 10:43 PM
~Cisa~
Ransomware actors are exploiting CVE-2024-57727 in unpatched SimpleHelp RMM to compromise downstream customers.
-
IOCs: CVE-2024-57727
-
#CVE202457727 #Ransomware #SimpleHelp #ThreatIntel
Ransomware actors are exploiting CVE-2024-57727 in unpatched SimpleHelp RMM to compromise downstream customers.
-
IOCs: CVE-2024-57727
-
#CVE202457727 #Ransomware #SimpleHelp #ThreatIntel
Eine kritische Sicherheitslücke mit Risiko-Höchstwertung in der Fernwartungssoftware SimpleHelp wird im Internet angegriffen. #Security
Fernwartung SimpleHelp: Schwachstelle wird angegriffen
Eine kritische Sicherheitslücke mit Risiko-Höchstwertung in der Fernwartungssoftware SimpleHelp wird im Internet angegriffen.
www.heise.de
June 30, 2026 at 7:19 AM
Eine kritische Sicherheitslücke mit Risiko-Höchstwertung in der Fernwartungssoftware SimpleHelp wird im Internet angegriffen. #Security
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
thehackernews.com
June 30, 2026 at 11:51 AM
Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
Urgent: SimpleHelp RMM (CVE-2024-57726-8) vulnerabilities allow attackers unauthorized access, creating admin accounts & installing backdoors (Sliver, Cloudflare Tunnel). Update SimpleHelp & restrict IP access immediately. Ransomware (Akira) risk.#SimpleHelpRMMVulnerability
February 6, 2025 at 6:07 PM
Urgent: SimpleHelp RMM (CVE-2024-57726-8) vulnerabilities allow attackers unauthorized access, creating admin accounts & installing backdoors (Sliver, Cloudflare Tunnel). Update SimpleHelp & restrict IP access immediately. Ransomware (Akira) risk.#SimpleHelpRMMVulnerability
U.S. CISA adds Microsoft Power Pages flaw to its Known Exploited Vulnerabilities catalog
U.S. CISA adds Microsoft Power Pages flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SimpleHelp vulnerability to its Known Exploited Vulnerabilities catalog.
securityaffairs.com
February 23, 2025 at 8:47 PM
U.S. CISA adds Microsoft Power Pages flaw to its Known Exploited Vulnerabilities catalog
DragonForce double-whammy: First hit an MSP, then use RMM software to push ransomware
DragonForce double-whammy: First hit an MSP, then use RMM software to push ransomware
SimpleHelp was the vector for the attack
DragonForce ransomware infected a managed service provider, and its customers, after attackers exploited security flaws in remote monitoring and management tool SimpleHelp.…
dlvr.it
May 28, 2025 at 6:50 AM
DragonForce double-whammy: First hit an MSP, then use RMM software to push ransomware