Hackers exploit SimpleHelp RMM flaws to deploy Sliver malware

Attackers exploited critical SimpleHelp RMM vulnerabilities to establish unauthorized RMM connections, run discovery, create persistent administrator accounts (e.g., "sqladmin", "fpmhlttech"), install the Sliver post-exploitation framework and a Cloudflare Tunnel disguised as svchost.exe, and subsequently compromise a Domain Controller; Field Effect confirmed active exploitation and observed indicators (attacker IP, C2 in the Netherlands) and signs consistent with Akira ransomware activity, and the vendor has released patches to address the CVEs.