DragonForce Exploits SimpleHelp Vulnerabilities to Breach MSP and Encrypt Customer Systems

The DragonForce ransomware group has orchestrated a significant supply chain attack by breaching a managed service provider (MSP) and exploiting its SimpleHelp remote monitoring and management (RMM) platform. By leveraging vulnerabilities identified as CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728, the threat actors infiltrated the MSP environment. They conducted reconnaissance on downstream customer systems, gathering detailed information including user data, device configurations, and network connections. Using this access, DragonForce attempted to deploy ransomware encryptors and exfiltrate data from customer networks.

According to cybersecurity firm Sophos, which investigated the incident, some customers were protected by endpoint defenses, but others were not as fortunate and suffered encryption of their systems and data theft. These compromised systems became targets of double-extortion schemes. Sophos has since shared indicators of compromise (IOCs) to aid other organizations in defending against similar intrusions.

The attack underscores the risk ransomware gangs pose to MSPs, which serve as gateways to numerous client networks. DragonForce, which has gained recent notoriety following high-profile breaches in the UK retail sector, continues to expand its operations by offering a white-label ransomware-as-a-service (RaaS) model. This makes it easier for affiliates to rebrand and deploy DragonForce ransomware, reinforcing its growing threat to global cybersecurity.