# Ransomware actors exploit unpatched SimpleHelp RMM vulnerability

Published: 2025-07-17 · Severity: severe · Sectors: energy, technology, infrastructure
Canonical: https://vorant.io/reports/274e790f-9c71-5916-b43d-eca9b021d634/ransomware-actors-exploit-unpatched-simplehelp-rmm-vulnerability

> Ransomware actors exploit CVE-2024-57727 path traversal in SimpleHelp RMM versions 5.5.7 and earlier to compromise utility billing software providers since January 2025.

Ransomware actors have been systematically exploiting CVE-2024-57727, a path traversal vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software versions 5.5.7 and earlier, since January 2025. The vulnerability allows attackers to gain unauthorized access to unpatched SimpleHelp instances, which are often embedded in third-party vendor software or used by managed service providers. By compromising RMM infrastructure, attackers can access downstream customers' networks, enabling double-extortion ransomware campaigns. CISA added CVE-2024-57727 to its Known Exploited Vulnerabilities catalog on February 13, 2025, confirming active exploitation in the wild.

The advisory targets software vendors embedding SimpleHelp, managed service providers using the tool, and end-user organizations running unpatched instances. Organizations are urged to immediately identify vulnerable versions by checking serverconfig.xml files, upgrade to the latest patched version, and conduct threat hunting for indicators of compromise including suspicious three-letter executable filenames created after January 2025. Vendors should isolate or shut down vulnerable SimpleHelp servers immediately and notify downstream customers to secure their endpoints. The guidance emphasizes that this reflects a broader pattern of ransomware operators targeting organizations through unpatched RMM software as an initial access vector.

## Mentioned in this report

- Vulnerabilities: CVE-2024-57727 (KEV)
- Threat actors: DragonForce
- Malware: Ransomware (unspecified variant)

## Detection guidance (public sample)

### SimpleHelp Remote Terminal winpty Named Pipes Created

ATT&CK: T1190

Detects creation of winpty named pipes used by SimpleHelp's remote terminal feature, which can indicate remote command access through a compromised or unauthorised SimpleHelp instance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SimpleHelp Remote Terminal winpty Named Pipes Created
description: Detects creation of winpty-conin/conout/control named pipes associated
  with the SimpleHelp remote terminal. Where SimpleHelp is not an approved tool, or
  the host belongs to a customer of an exploited RMM or MSP (CVE-2024-57727), this
  suggests attacker remote shell access.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \winpty-conin-*
    - \winpty-conout-*
    - \winpty-control-*
  condition: selection
falsepositives:
- Legitimate SimpleHelp remote support sessions that use the terminal feature
- Other software that embeds the winpty library for terminal emulation
level: medium
id: e00b3ecc-6239-5ca1-bb91-3cc8cca055ab
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a
```

### Three-Letter Executable Dropped in Common Staging Directory

ATT&CK: T1486

Detects creation of executables with three-letter names in world-writable staging locations, matching the report's hunting guidance for ransomware payloads dropped via compromised RMM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Three-Letter Executable Dropped in Common Staging Directory
description: Detects creation of executables with a three-letter base name in ProgramData,
  Users\Public or Windows\Temp. The report advises hunting for suspicious three-letter
  executable names created after the SimpleHelp exploitation, which were used to stage
  ransomware. Needs triage against known short-named tools.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|re: ^[A-Za-z]:\\(ProgramData|Users\\Public|Windows\\Temp)\\[A-Za-z]{3}\.exe$
  condition: selection
falsepositives:
- Legitimate short-named utilities such as vendor installers or helper tools unpacked
  to ProgramData
- Software updaters that stage short-named executables in Windows Temp
level: medium
id: ae20ad9d-a8fe-5d87-9faa-0fda7f226618
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a
```

### Shadow Copy Deletion or Recovery Inhibition Typical of Ransomware

ATT&CK: T1486

Detects commands that delete volume shadow copies or disable recovery, commonly run just before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy Deletion or Recovery Inhibition Typical of Ransomware
description: Detects vssadmin or wmic shadow copy deletion and bcdedit recovery disabling,
  which ransomware operators run before encrypting data in double-extortion campaigns.
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or disk-management scripts that purge shadow copies to reclaim space
- Administrators preparing systems for imaging
level: high
id: 4ac4036c-5832-59ea-bab2-80b12f2a4c9d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/274e790f-9c71-5916-b43d-eca9b021d634/ransomware-actors-exploit-unpatched-simplehelp-rmm-vulnerability.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup