Illustration: JMiks | Shutterstock
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory warning companies of a ransomware attack on an unnamed utility billing software provider. The attack exploited an unpatched version of SimpleHelp’s remote monitoring and management (RMM) tool.
According to CISA, this isn’t an isolated incident. The report claims that “this incident reflects a broader pattern of ransomware actors targeting organizations through unpatched versions of SimpleHelp RMM since January 2025.” SimpleHelp had patched its software in a January update, but versions older than 5.5.7 remain vulnerable to CVE-2024-57727 and several other vulnerabilities.
In this case, ransomware operators exploited CVE-2024-57727, a path traversal vulnerability, to access outdated versions run by SimpleHelp customers. Exploitation has led to disrupted services and double extortion compromises.
This isn’t the first time this vulnerability has been exploited, and CISA isn’t the only authority that has issued warnings about it either. The CISA, the Federal Bureau of Investigation (FBI), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) had issued a warning on June 4 against the Play ransomware group, which was caught exploiting the same SimpleHelp security vulnerability in double extortion attacks.
For breached companies, CISA’s latest advisory suggests using SimpleHelp’s remote access tools to look for any evidence of compromise and update to the latest version of the software as soon as possible. As for the breaches, Candid.Technology hasn’t seen any major ransomware groups claiming new attacks that might be related to the advisory at the time of writing.
That said, ransomware negotiations usually take a few weeks before the targeted company or the ransomware group end up publicly revealing the attack, so it might just be a matter of time before this or more victims come to light. Since these cases also usually involve data theft, a sale attempt can also be made on underground hacking forums.
In the News: Graphite spyware found targeting European journalists
