SimpleHelp
Remote monitoring and management tool; CVEs 2024-57726/57728 used by DragonForce as ransomware initial access.
Last refreshed: 8 May 2026 · Appears in 1 active topic
How many MSP client networks are exposed when DragonForce gains control of a single SimpleHelp instance?
Timeline for SimpleHelp
Carried the SSO authentication-bypass flaw
Cybersecurity: Threats and Defences: Cisco tops a five-vendor KEV batchKB5091157, Gentlemen C2 intel, ENISA CNAs: in brief
Cybersecurity: Threats and DefencesBackground
SimpleHelp is a remote monitoring and management (RMM) software platform used by managed service providers and IT teams to remotely support end-user devices. In the U#3 reporting period, Arctic Wolf confirmed that DragonForce ransomware affiliates are exploiting CVE-2024-57726 and CVE-2024-57728 in SimpleHelp as an initial access vector for intrusions linked to The Gentlemen RaaS ecosystem.
CVE-2024-57726 and CVE-2024-57728 are authentication bypass and privilege escalation vulnerabilities respectively, disclosed in late 2024 and patched by SimpleHelp's developers. NHS Digital issued cyber alert CC-4623 in 2025 specifically warning about SimpleHelp exploitation, ahead of the May 2026 confirmation. The gap between NHS Digital's warning and confirmed ransomware use illustrates the lag between threat-intelligence advisories and actual mitigation in mid-market and SME environments that rely on MSPs for their IT support.
The abuse of legitimate RMM tools is a growing tactic: because RMM software is designed to have extensive remote access capabilities, attackers who gain control of an RMM instance can move laterally through every client network the MSP supports from a single compromised console. SimpleHelp is widely used in the UK SME and healthcare sectors, explaining NHS Digital's 2025 alert.