Sophos researchers uncovered a cyberattack where DragonForce ransomware operators exploited three chained vulnerabilities in the SimpleHelp remote management tool to compromise an MSP and its customers. The attackers used these vulnerabilities to gain administrative access, deploy ransomware, and steal data from multiple clients. While one client with Sophos MDR and XDR defenses successfully blocked the attack, others were compromised, resulting in significant data leaks and potential operational disruptions.
Source: https://cybersafe.news/dragonforce-exploits-simplehelp-flaws-to-breach-msp/
TPRM report: https://scoringcyber.rankiteo.com/company/simplehelp-ltd
"id": "sim740052825",
"linkid": "simplehelp-ltd",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'IT Services',
'name': 'Managed Service Provider (MSP)',
'type': 'Service Provider'}],
'attack_vector': 'Exploitation of vulnerabilities in SimpleHelp remote '
'management tool',
'data_breach': {'data_exfiltration': 'Yes',
'type_of_data_compromised': 'Host information, user data, and '
'network configurations'},
'date_detected': '2025-01-22',
'description': 'DragonForce ransomware operators exploited three chained '
'vulnerabilities in the SimpleHelp remote management tool to '
'compromise a managed service provider (MSP) and its '
'customers.',
'impact': {'data_compromised': 'Host information, user data, and network '
'configurations',
'systems_affected': 'SimpleHelp servers and client environments'},
'initial_access_broker': {'entry_point': 'SimpleHelp remote management tool'},
'investigation_status': 'Ongoing investigation by Sophos Rapid Response',
'motivation': 'Encrypting and stealing victim data',
'post_incident_analysis': {'root_causes': 'Vulnerabilities in SimpleHelp '
'remote management tool'},
'ransomware': {'data_encryption': 'Yes',
'data_exfiltration': 'Yes',
'ransomware_strain': 'DragonForce'},
'references': [{'source': 'Sophos', 'url': 'https://github.com/sophos/'}],
'response': {'containment_measures': 'Sophos Rapid Response engaged to '
'contain and investigate the breach'},
'threat_actor': 'DragonForce ransomware group',
'title': 'DragonForce Ransomware Attack on MSP via SimpleHelp Vulnerabilities',
'type': 'Ransomware',
'vulnerability_exploited': ['CVE-2024-57727',
'CVE-2024-57728',
'CVE-2024-57726']}