DragonForce ransomware exploits SimpleHelp vulnerabilities in MSP supply chain attack
Take action: A compromise of a trusted vendor has terrible and far reaching consequences. There isn't an obvious solution. You need to do a lot of little things and do them consistently - vendor assessment and questionnaires putting formal pressure, isolation and access restrictions adding a layer of prevention and patching and intrusion detection as an internal layer of defense.
Learn More
Sophos reports a supply chain attack orchestrated by the DragonForce ransomware group that has compromised an unidentified Managed Service Provider (MSP) and multiple downstream customers through the exploitation of vulnerabilities in SimpleHelp remote monitoring and management (RMM) software.
The attack involved hackers gaining access to the MSP's SimpleHelp RMM tool and using it to deploy DragonForce ransomware across multiple endpoints while stealing sensitive data. Sophos researchers have medium confidence that the attack exploited a chain of three critical vulnerabilities in SimpleHelp that were disclosed in January 2025:
- CVE-2024-57727 (CVSS score 7.5): Multiple path traversal vulnerabilities
- CVE-2024-57728 (CVSS score 7.2): Arbitrary file upload vulnerability
- CVE-2024-57726 (CVSS score 9.9): Privilege escalation vulnerability
The attack began when threat actors accessed the MSP's SimpleHelp RMM instance and injected a malicious installer file that appeared to be legitimate software. This installer was deployed through the MSP's own infrastructure to its clients.
The attackers used this installer to gain access and conduct reconnaissance across multiple customer environments managed by the MSP, systematically collecting device names and configurations, user information, and network connection details. Once within the networks, the attackers exfiltrated sensitive client data and deployed DragonForce ransomware to encrypt systems.
The exposed data included:
- Device names and configurations
- User information
- Network connection details
- Sensitive client data (specific types not disclosed)
The exact number of affected individuals and the financial value of the incident are not disclosed. Sophos was unable to identify the specific MSP targeted or provide precise numbers regarding how many customers were ultimately impacted by the ransomware and data theft.
While one of the MSP's clients successfully blocked the attack through Sophos MDR and extended detection and response capabilities, multiple other downstream customers were impacted by both ransomware encryption and data exfiltration.
