DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints

The threat actors behind the DragonForce ransomware gained access to an unnamed Managed Service Provider's MSP SimpleHelp remote monitoring and management RMM tool, and then leveraged it to exfiltrate data and drop the locker on multiple endpoints. It's believed that the attackers exploited a tri...

CVE-2024-57728

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...

CVE-2024-57728

creationtimestamp| type| source ---|---|--- 2025-01-15 07:04:46+00:00| seen| https://bsky.app/profile/hackingne.ws/post/3lfr77ikywk22 2025-01-15 13:18:05+00:00| seen| https://t.me/truesecator/6621 2025-01-15 17:18:02+00:00| seen| https://bsky.app/profile/tmjintel.bsky.social/post/3lfsbi3fw5c25...

CVE-2024-57728

CVE-2024-57728 affects SimpleHelp remote support software versions 5.5.7 and earlier. The flaw allows an admin to upload arbitrary files via a crafted zip (zip slip), enabling remote code execution on the SimpleHelp server when exploited in the admin context. Connected documents describe an attac...

CVE-2024-57728

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...

CVE-2024-57728

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user...