Arctic Wolf Observes Campaign Exploiting SimpleHelp RMM Software for Initial Access

Arctic Wolf observed an active campaign (reported 2025-01-22) involving unauthorized access to devices using SimpleHelp RMM, potentially linked to recently disclosed SimpleHelp vulnerabilities (CVE-2024-57726/57727/57728) that allow arbitrary file download/upload and privilege escalation; the campaign showed client communications to an unapproved SimpleHelp server and basic domain enumeration before sessions were terminated. Arctic Wolf recommends upgrading affected SimpleHelp server versions, uninstalling unused clients, rotating passwords, and restricting IPs, and notes historical abuse of RMM tools by ransomware and state-aligned actors.