Threat reportRansomwareTL-2026-3794
DragonForce Ransomware Delivered via Compromised MSP SimpleHelp RMM (CVE-2024-57726/57727/57728) — Managed Service Supply-Chain Attack
DragonForce Ransomware Delivered via Compromised MSP (TL-2026-3794), also tracked as DragonForce SimpleHelp MSP campaign, is a high-severity ransomware operation, first published 2026-10-17. It is attributed to DragonForce ransomware operators with low confidence, affects SimpleHelp SimpleHelp remote support / RMM server, references 3 CVEs (CVE-2024-57727, CVE-2024-57728, CVE-2024-57726), maps to 11 MITRE ATT&CK techniques (T1033, T1049, T1059.003), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 1DragonForce ransomware operators
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3794
- Threat ID
- TL-2026-3794
- Also known as
- DragonForce SimpleHelp MSP campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- DragonForce ransomware operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- managed service providers, retail, technology
- Target regions
- Global, united kingdom, united states of america
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in DragonForce Ransomware Delivered via Compromised MSP
Malware and tooling: DragonForce, RansomHub - S1212, SimpleHelp
How DragonForce Ransomware Delivered via Compromised MSP works
A DragonForce ransomware operator compromised a managed service provider's SimpleHelp RMM server and used it to run reconnaissance, steal data and push ransomware to the MSP's customers. Sophos MDR assessed with medium confidence that the actor chained SimpleHelp flaws CVE-2024-57727, CVE-2024-57728 and CVE-2024-57726.
In an incident documented by Sophos on 2025-05-27 (and summarized by Deep Instinct on 2025-06-26 as a case for scanning trusted third-party updates), a threat actor gained access to an MSP's SimpleHelp remote monitoring and management (RMM) instance and used it as a delivery channel into multiple downstream customer environments. Sophos MDR has medium confidence that the actor exploited a chain of SimpleHelp vulnerabilities disclosed in January 2025: CVE-2024-57727 (multiple unauthenticated path traversals allowing arbitrary file download, including serverconfig.xml with hashed admin/technician passwords, LDAP credentials, and per Horizon3 also OIDC secrets, API keys and TOTP seeds), CVE-2024-57728 (arbitrary file upload by admin/privileged technician leading to RCE via crontab injection on Linux or overwriting executables/libraries on Windows) and CVE-2024-57726 (technician-to-admin privilege escalation through missing backend authorization checks).
Once in control of the MSP's SimpleHelp server, the actor used the legitimate RMM to collect information from customer endpoints (device names, configuration, users and network connections) and pushed a malicious SimpleHelp installer to customer machines. The DragonForce ransomware binary was staged under the SimpleHelp JWrapper toolbox working directory (C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\working\toolbox-<id>\win.exe) and a batch script named 'PUSH PUSh PUUUUUSH.bat' was used to enumerate and remove Windows event logs. The actor attempted double extortion (data theft plus encryption) across several customer estates. One customer protected by Sophos MDR/XDR had encryption blocked by behavioral and malware detection and incident-response containment; other customers were affected.
Context: DragonForce is a ransomware-as-a-service brand that emerged in mid-2023 and in March 2025 began rebranding as a 'cartel' with a distributed affiliate model. Sophos notes that well-known affiliates, including Scattered Spider (UNC3944), previously associated with RansomHub, have used DragonForce against UK and US retail chains; the sources do not attribute this specific MSP intrusion to a named affiliate. The Deep Instinct article argues that updates and files pushed by trusted third parties such as MSPs should be scanned rather than implicitly trusted. CVE-2024-57727 was added to CISA KEV on 2025-02-13 (due 2025-03-06). No network IOCs (IPs/domains) were published; the IOC set is file-based.
MITRE ATT&CK techniques used in TL-2026-3794
Discovery
T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1082 System Information Discovery
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell
Initial Access
T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1199 Trusted Relationship
Command and Control
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files
Exfiltration
T1567 Exfiltration Over Web Service
defense-impairment
Affected products and versions in DragonForce Ransomware Delivered via Compromised MSP
- SimpleHelp — SimpleHelp remote support / RMM server
Vulnerable versions: 5.5.7 and earlier; versions prior to 5.5.8, 5.4.10 and 5.3.9
Fixed in: 5.5.8; 5.4.10; 5.3.9
Remediation for DragonForce Ransomware Delivered via Compromised MSP
Patches
- SimpleHelp 5.5.8, 5.4.10 and 5.3.9 (fixes for CVE-2024-57726/57727/57728)
Immediate actions
- Upgrade SimpleHelp servers to 5.5.8, 5.4.10 or 5.3.9 or later and take internet-exposed SimpleHelp servers offline until patched
- Rotate all SimpleHelp admin, technician, LDAP, OIDC, API and TOTP secrets that may have been in serverconfig.xml
- Review SimpleHelp server logs for unauthenticated requests to configuration paths, unexpected technician-to-admin changes and file uploads to unusual directories
- Hunt customer endpoints for win.exe under C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\working\ and for 'PUSH PUSh PUUUUUSH.bat'
Workarounds
- Restrict network exposure of the SimpleHelp server to trusted management networks
- Enforce MFA and least privilege for technician accounts
Longer-term hardening
- Scan files and updates pushed by MSPs and other trusted third parties before execution rather than trusting them implicitly
- Deploy EDR/XDR with behavioral and ransomware detection on customer and MSP endpoints
- Restrict and monitor RMM tool installations and allowlist only sanctioned RMM instances
- Maintain immutable, offline backups and monitor for Windows event log clearing
CVEs associated with DragonForce Ransomware Delivered via Compromised MSP
Weaknesses (CWE) in DragonForce Ransomware Delivered via Compromised MSP
Timeline of DragonForce Ransomware Delivered via Compromised MSP
- DragonForce ransomware-as-a-service brand first emerges (mid-2023, per Sophos).
- Horizon3.ai reports the SimpleHelp vulnerabilities to the vendor (per Security Affairs).
- Horizon3.ai publicly discloses CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728; SimpleHelp releases fixed versions 5.5.8, 5.4.10 and 5.3.9.
- CVE-2024-57727 published in NVD (CVSS 7.5 primary).
- Active exploitation of SimpleHelp flaws observed in late January 2025 (Arctic Wolf, per Security Affairs; day approximate).
- CISA adds CVE-2024-57727 to the Known Exploited Vulnerabilities catalog (remediation due 2025-03-06).
- DragonForce begins rebranding as a 'cartel' with a distributed affiliate model (March 2025; day approximate).
- Sophos publishes analysis of a DragonForce operator abusing an MSP's SimpleHelp RMM to attack customers and releases IOCs.
- Help Net Security and others report the MSP compromise and RMM-delivered ransomware.
- Deep Instinct publishes 'Managed Service Malware: The Case for Scanning Everything', arguing trusted third-party updates must be scanned.
Sources cited for DragonForce Ransomware Delivered via Compromised MSP
- Managed Service Malware: The Case for Scanning Everything (Deep Instinct)
- DragonForce actors target SimpleHelp vulnerabilities to attack MSP customers (Sophos)
- Sophos Labs IOC list: 2505 DragonForce targets SimpleHelp RMM
- Attackers hit MSP, use its RMM software to deliver ransomware to clients (Help Net Security)
- DragonForce operator chained SimpleHelp flaws to target an MSP and its customers (Security Affairs)
- DragonForce Ransomware Strikes MSP in Supply Chain Attack (Dark Reading)
- Critical vulnerabilities in SimpleHelp remote support software (Horizon3.ai)
- NVD: CVE-2024-57727
- CISA Known Exploited Vulnerabilities Catalog (CVE-2024-57727 added)
Detection coverage for TL-2026-3794
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3794 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.