DragonForce Ransomware Hackers Exploiting SimpleHelp Vulnerabilities

An unidentified managed service provider (MSP) and its customers have been infected with the DragonForce ransomware after a threat actor exploited a vulnerable SimpleHelp instance, according to a warning from anti-malware firm Sophos.

For initial access, Sophos believes ransomware operator chained three vulnerabilities in the remote monitoring and management (RMM) software.

The bugs, tracked as CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726, lets attackers to retrieve logs, configuration files, and credentials; log in with high privileges to upload files and execute code; and elevate their privileges to administrator, fully compromising target systems.

SimpleHelp released fixes for the three software flaws in mid-January and threat actors started chaining them in attacks two weeks later to hit unpatched internet-facing SimpleHelp instances.

Now, Sophos says that the three security defects were likely chained to access an unnamed MSP’s SimpleHelp deployment that the MSP was hosting and operating for its customers.

Using the RMM, the attackers collected information on the MSP’s customers, “collecting device names and configuration, users, and network connections”, Sophos says.

The threat actor also exfiltrated sensitive information and deployed the DragonForce ransomware, impacting both the MSP and its customers.

The DragonForce ransomware group gained a lot of attention over the past month, after claiming attacks on UK retailers Marks & Spencer (M&S), Co-op, Harrods, and after a Google warning that it switched focus to US retailers.

Active since mid-2023 and operating as a ransomware-as-a-service (RaaS), DragonForce took over the infrastructure of RansomHub. A threat actor known as Scattered Spider and UNC3944, which was a RansomHub affiliate, has been using DragonForce in attacks recently, according to reports..

In November 2024, the US announced charges against five members of Scattered Spider, after the group’s suspected leader and an alleged member of the gang were arrested in the UK last summer.

Related: Hundreds of Thousands Hit by Data Breaches at Healthcare Firms

Related: Suspected DoppelPaymer Ransomware Group Member Arrested

Related: Security Firm Andy Frain Says 100,000 Impacted by Ransomware Attack