# DragonForce Ransomware Delivered via Compromised MSP SimpleHelp RMM (CVE-2024-57726/57727/57728) — Managed Service Supply-Chain Attack

> A DragonForce ransomware operator compromised a managed service provider's SimpleHelp RMM server and used it to run reconnaissance, steal data and push ransomware to the MSP's customers. Sophos MDR assessed with medium confidence that the actor chained SimpleHelp flaws CVE-2024-57727, CVE-2024-57728 and CVE-2024-57726.

- **Published:** 2026-10-17T01:33:53Z
- **Last reviewed:** 2026-10-17T01:33:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3794
- **ID:** TL-2026-3794
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** DragonForce ransomware operators
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-57727, CVE-2024-57728, CVE-2024-57726

## Description

In an incident documented by Sophos on 2025-05-27 (and summarized by Deep Instinct on 2025-06-26 as a case for scanning trusted third-party updates), a threat actor gained access to an MSP's SimpleHelp remote monitoring and management (RMM) instance and used it as a delivery channel into multiple downstream customer environments. Sophos MDR has medium confidence that the actor exploited a chain of SimpleHelp vulnerabilities disclosed in January 2025: CVE-2024-57727 (multiple unauthenticated path traversals allowing arbitrary file download, including serverconfig.xml with hashed admin/technician passwords, LDAP credentials, and per Horizon3 also OIDC secrets, API keys and TOTP seeds), CVE-2024-57728 (arbitrary file upload by admin/privileged technician leading to RCE via crontab injection on Linux or overwriting executables/libraries on Windows) and CVE-2024-57726 (technician-to-admin privilege escalation through missing backend authorization checks).

Once in control of the MSP's SimpleHelp server, the actor used the legitimate RMM to collect information from customer endpoints (device names, configuration, users and network connections) and pushed a malicious SimpleHelp installer to customer machines. The DragonForce ransomware binary was staged under the SimpleHelp JWrapper toolbox working directory (C:\ProgramData\JWrapper-Remote Access\JWAppsSharedConfig\working\toolbox-<id>\win.exe) and a batch script named 'PUSH PUSh PUUUUUSH.bat' was used to enumerate and remove Windows event logs. The actor attempted double extortion (data theft plus encryption) across several customer estates. One customer protected by Sophos MDR/XDR had encryption blocked by behavioral and malware detection and incident-response containment; other customers were affected.

Context: DragonForce is a ransomware-as-a-service brand that emerged in mid-2023 and in March 2025 began rebranding as a 'cartel' with a distributed affiliate model. Sophos notes that well-known affiliates, including Scattered Spider (UNC3944), previously associated with RansomHub, have used DragonForce against UK and US retail chains; the sources do not attribute this specific MSP intrusion to a named affiliate. The Deep Instinct article argues that updates and files pushed by trusted third parties such as MSPs should be scanned rather than implicitly trusted. CVE-2024-57727 was added to CISA KEV on 2025-02-13 (due 2025-03-06). No network IOCs (IPs/domains) were published; the IOC set is file-based.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1552.001 Unsecured Credentials: Credentials In Files
- T1082 System Information Discovery
- T1049 System Network Connections Discovery
- T1033 System Owner/User Discovery
- T1219 Remote Access Tools
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1685.005 Clear Windows Event Logs
- T1567 Exfiltration Over Web Service

## Sources

- [Managed Service Malware: The Case for Scanning Everything (Deep Instinct)](https://www.deepinstinct.com/blog/managed-service-malware-the-case-for-scanning-everything)
- [DragonForce actors target SimpleHelp vulnerabilities to attack MSP customers (Sophos)](https://www.sophos.com/en-us/blog/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers)
- [Sophos Labs IOC list: 2505 DragonForce targets SimpleHelp RMM](https://github.com/sophoslabs/IoCs/blob/master/2505%20DragonForce%20targets%20SimpleHelp%20RMM.csv)
- [Attackers hit MSP, use its RMM software to deliver ransomware to clients (Help Net Security)](https://www.helpnetsecurity.com/?p=332171)
- [DragonForce operator chained SimpleHelp flaws to target an MSP and its customers (Security Affairs)](https://securityaffairs.com/?p=178350)
- [DragonForce Ransomware Strikes MSP in Supply Chain Attack (Dark Reading)](https://www.darkreading.com/application-security/dragonforce-ransomware-msp-supply-chain-attack)
- [Critical vulnerabilities in SimpleHelp remote support software (Horizon3.ai)](https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/)
- [NVD: CVE-2024-57727](https://nvd.nist.gov/vuln/detail/CVE-2024-57727)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2024-57727 added)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3794