DragonForce Ransomware Leverages SimpleHelp Exploits to Hit MSPs

DragonForce exploited known SimpleHelp RMM vulnerabilities to compromise an MSP and its downstream clients, using the MSP's legitimate RMM instance to deploy malicious installers, exfiltrate device and user data, and execute double-extortion ransomware; the campaign leveraged chained CVE-2024-57726 and CVE-2024-57727 exploits and displayed RaaS sophistication including log-wiping and evasion, highlighting severe supply-chain and trust-based risks for MSP-managed environments.