Arctic Wolf Observes Campaign Exploiting SimpleHelp RMM Software for Initial Access

Arctic Wolf observed an active campaign leveraging unauthorised access to SimpleHelp RMM instances after public disclosure of multiple vulnerabilities; actors could chain flaws to achieve administrative control of servers and compromise connected client devices. The advisory documents observed indicators (communications to unapproved SimpleHelp servers and command enumeration via cmd.exe), recommends upgrading to fixed SimpleHelp versions, uninstalling unused clients, rotating passwords, and restricting IPs to mitigate risk.