Ransomware actors exploit unpatched SimpleHelp RMM vulnerability

17 July 2025 severe threat energytechnologyinfrastructure

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Ransomware actors exploit CVE-2024-57727 path traversal in SimpleHelp RMM versions 5.5.7 and earlier to compromise utility billing software providers since January 2025.

Ransomware actors have been systematically exploiting CVE-2024-57727, a path traversal vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software versions 5.5.7 and earlier, since January 2025. The vulnerability allows attackers to gain unauthorized access to unpatched SimpleHelp instances, which are often embedded in third-party vendor software or used by managed service providers. By compromising RMM infrastructure, attackers can access downstream customers' networks, enabling double-extortion ransomware campaigns. CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities catalog on February 13, 2025, confirming active exploitation in the wild.

The advisory targets software vendors embedding SimpleHelp, managed service providers using the tool, and end-user organizations running unpatched instances. Organizations are urged to immediately identify vulnerable versions by checking serverconfig.xml files, upgrade to the latest patched version, and conduct threat hunting for indicators of compromise including suspicious three-letter executable filenames created after January 2025. Vendors should isolate or shut down vulnerable SimpleHelp servers immediately and notify downstream customers to secure their endpoints. The guidance emphasizes that this reflects a broader pattern of ransomware operators targeting organizations through unpatched RMM software as an initial access vector.

Mentioned in this report

Vulnerabilities CVE-2024-57727KEV

Threat actors DragonForce

Malware Ransomware (unspecified variant)

Detection guidance

SimpleHelp Remote Terminal winpty Named Pipes Created

ATT&CK T1190

Detects creation of winpty named pipes used by SimpleHelp's remote terminal feature, which can indicate remote command access through a compromised or unauthorised SimpleHelp instance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: SimpleHelp Remote Terminal winpty Named Pipes Created
description: Detects creation of winpty-conin/conout/control named pipes associated
  with the SimpleHelp remote terminal. Where SimpleHelp is not an approved tool, or
  the host belongs to a customer of an exploited RMM or MSP (CVE-2024-57727), this
  suggests attacker remote shell access.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \winpty-conin-*
    - \winpty-conout-*
    - \winpty-control-*
  condition: selection
falsepositives:
- Legitimate SimpleHelp remote support sessions that use the terminal feature
- Other software that embeds the winpty library for terminal emulation
level: medium
id: e00b3ecc-6239-5ca1-bb91-3cc8cca055ab
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a

Three-Letter Executable Dropped in Common Staging Directory

ATT&CK T1486

Detects creation of executables with three-letter names in world-writable staging locations, matching the report's hunting guidance for ransomware payloads dropped via compromised RMM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Three-Letter Executable Dropped in Common Staging Directory
description: Detects creation of executables with a three-letter base name in ProgramData,
  Users\Public or Windows\Temp. The report advises hunting for suspicious three-letter
  executable names created after the SimpleHelp exploitation, which were used to stage
  ransomware. Needs triage against known short-named tools.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|re: ^[A-Za-z]:\\(ProgramData|Users\\Public|Windows\\Temp)\\[A-Za-z]{3}\.exe$
  condition: selection
falsepositives:
- Legitimate short-named utilities such as vendor installers or helper tools unpacked
  to ProgramData
- Software updaters that stage short-named executables in Windows Temp
level: medium
id: ae20ad9d-a8fe-5d87-9faa-0fda7f226618
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a

Shadow Copy Deletion or Recovery Inhibition Typical of Ransomware

ATT&CK T1486

Detects commands that delete volume shadow copies or disable recovery, commonly run just before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shadow Copy Deletion or Recovery Inhibition Typical of Ransomware
description: Detects vssadmin or wmic shadow copy deletion and bcdedit recovery disabling,
  which ransomware operators run before encrypting data in double-extortion campaigns.
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or disk-management scripts that purge shadow copies to reclaim space
- Administrators preparing systems for imaging
level: high
id: 4ac4036c-5832-59ea-bab2-80b12f2a4c9d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs