Cybercriminals Exploit SimpleHelp Flaws to Distribute Malware

Cybersecurity researchers have uncovered active exploitation of critical vulnerabilities in SimpleHelp Remote Monitoring and Management (RMM) software, enabling cybercriminals to infiltrate networks, deploy backdoors, and potentially prepare for ransomware attacks.

The flaws, tracked as CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728, were disclosed in January 2025 by Horizon3.ai and subsequently patched.

However, attackers have leveraged unpatched systems to establish unauthorized access and execute malicious activities.

Exploitation Details: Initial Access and Persistence

Threat actors exploited the SimpleHelp RMM client to gain initial access to targeted endpoints.

Using an Estonian-based server running a SimpleHelp instance, attackers executed discovery commands to gather system and network details, user accounts, and domain controller information.

They then created unauthorized administrator accounts, such as “sqladmin,” to maintain access.

This was followed by the deployment of the Sliver post-exploitation framework, a tool often used for command-and-control operations due to its stealthy capabilities.

The Sliver malware was configured to communicate with command-and-control servers in the Netherlands via encrypted channels.

Additionally, attackers utilized Cloudflare Tunnels disguised as legitimate Windows processes (e.g., svchost.exe) to maintain persistence and evade detection.

These mechanisms allowed attackers to bypass security controls and establish long-term footholds within compromised networks.

Vulnerabilities and Attack Techniques

The three vulnerabilities exploited include:

1. CVE-2024-57727: A path traversal flaw enabling unauthenticated attackers to download sensitive files from the SimpleHelp server, including configuration files containing hashed credentials.
2. CVE-2024-57728: An arbitrary file upload vulnerability allowing attackers with administrative privileges to execute remote code on the server.
3. CVE-2024-57726: A privilege escalation flaw that enables low-privilege users to gain administrative rights by exploiting missing backend authorization checks.

When chained together, these vulnerabilities allow attackers to compromise both the SimpleHelp server and connected client machines.

Field Effect Security Intelligence observed that these attacks bear similarities to tactics associated with the Akira ransomware group but lacked sufficient evidence for definitive attribution.

The exploitation of these vulnerabilities could lead to widespread ransomware deployment or data theft if not mitigated promptly.

Organizations using SimpleHelp are urged to take immediate action:

• Update SimpleHelp software to patched versions (5.5.8, 5.4.10, or 5.3.9) released in January 2025.
• Restrict access to SimpleHelp servers by implementing multi-factor authentication (MFA) and IP whitelisting.
• Monitor for indicators of compromise such as unauthorized administrator accounts (“sqladmin” or “fpmhlttech”) or connections to suspicious IPs.
• Conduct regular security audits and remove unused SimpleHelp clients from systems.

This incident underscores the importance of timely patch management and proactive threat monitoring to mitigate risks posed by newly disclosed vulnerabilities in widely used software solutions.

Also Read:

New Copyright Infringement Phishing Hijacks Your Facebook Account

See more