Article Details
Scrape Timestamp (UTC): 2025-06-12 23:59:31.641
Source: https://www.theregister.com/2025/06/12/cisa_simplehelp_flaw_exploit_warning/
Original Article Text
Click to Toggle View
Ransomware scum disrupted utility services with SimpleHelp attacks. Good news: The vendor patched the flaw in January. Bad news: Not everyone got the memo. Ransomware criminals infected a utility billing software providers' customers, and in some cases disrupted services, after exploiting unpatched versions of SimpleHelp’s remote monitoring and management (RMM) tool, according to a Thursday CISA alert. "This incident is part of a broader trend of ransomware actors exploiting unpatched versions of SimpleHelp RMM since January 2025," the security advisory warned. "Ransomware actors likely exploited CVE-2024-57727 to access downstream customers' unpatched SimpleHelp RMM, resulting in service disruptions and double extortion incidents." CVE-2024-57727 is a high-severity path traversal vulnerability that affects SimpleHelp 5.5.7 and prior versions. The vendor fixed the hole in January, but ransomware crews reportedly exploited unpatched versions. The cyber-defense agency's warning follows a similar advisory from the feds, issued last week, about Play ransomware gang members exploiting the same SimpleHelp security flaw in double-extortion attacks. Those incidents see criminals first steal sensitive data, then encrypt victims' files, before threatening to release the stolen information online unless the victims pay up. Play ransomware was among the top five targeting critical infrastructure last year. CISA's very brief advisory encourages organizations using SimpleHelp's remote-access tool to search for evidence of compromise and patch CVE-2024-57727 if they haven't already. Neither SimpleHelp nor CISA immediately responded to The Register's inquiries regarding the scope and scale of attacks abusing the remote-management software. We will update this story if we receive responses. The CISA advisory also follows an earlier report about DragonForce ransomware infecting a managed service provider and its customers after exploiting CVE-2024-57727. In addition to deploying their encryptor across multiple endpoints, the criminals also stole sensitive data and double-extortion tactics to pressure the victims into paying a ransom.
Daily Brief Summary
Ransomware attackers targeted utilities by exploiting a vulnerability in the SimpleHelp remote management tool.
The security flaw, identified as CVE-2024-57727, affected versions of SimpleHelp up to 5.5.7, allowing unauthorized remote access.
Despite a patch released in January, many users failed to update, leaving systems exposed to ransomware attacks.
Incidents involved service disruptions and double extortion tactics, where attackers stole sensitive data before encrypting files.
CISA issued an alert highlighting the ongoing risk and urged organizations to patch affected systems immediately.
The Play ransomware group was noted for similar attacks targeting critical infrastructure using this vulnerability.
Additional threats included DragonForce ransomware exploiting the same flaw to attack managed service providers and their clients.
The series of attacks underline the critical importance of timely software updates in preventing ransomware incidents.