DragonForce double-whammy: First hit an MSP, then use RMM software to push ransomware – Source: go.theregister.com

DragonForce ransomware infected a managed service provider, and its customers, after attackers exploited security flaws in remote monitoring and management tool SimpleHelp.

In addition to deploying DragonForce ransomware across “multiple” endpoints, the criminals also stole sensitive data and used double-extortion tactics to pressure victims into paying the ransom, according to security shop Sophos. The company’s researchers didn’t identify the managed service provider (MSP) nor how many customers were affected. We’ve asked both Sophos and SimpleHelp for more details and will update this article if we hear back.

DragonForce is a new-ish ransomware-as-a-service gang that gained notoriety in April after cybercrime “cartel” Scattered Spider used its ransomware to infect major retailers in the UK and US, then began offering a service that allows other crooks to use DragonForce’s infrastructure and tools to deploy any type of ransomware.

MSPs are always a hot target for criminals because they offer a one-to-many attack: infecting a single MSP creates the chance to gain access to all of its customers’ networks.

In this case, exploiting SimpleHelp’s software provides an even bigger bang for the buck – it’s a legitimate remote monitoring and management (RMM) product that has thousands of customers, theoretically allowing the crooks to push the malware to multiple IT environments as if it were a legit software update.

When DragonForce exploited SimpleHelp’s vulnerabilities, they didn’t just breach a single organization, they hijacked a distribution system

According to SimpleHelp’s website, the RMM tool is “installed and actively used on thousands of servers. Many hundreds of thousands of machines are accessible through SimpleHelp servers.” While in this case only one MSP’s customers were affected, it’s easy to imagine how a flaw like this could spiral.

Sophos said it initially spotted the DragonForce infection after detecting a suspicious installation of a SimpleHelp installer file, pushed via a legitimate SimpleHelp RMM instance.

“The attacker also used their access through the MSP’s RMM instance to gather information on multiple customer estates managed by the MSP, including collecting device names and configuration, users, and network connections,” the security firm wrote in a Tuesday advisory.

It’s a worst-case scenario: A supply-chain attack against an MSP, which Jon Miller, CEO and co-founder of anti-ransomware outfit Halcyon said marks a whole new level of chaos.

“Supply chain attacks are already a nightmare — one vendor gets popped, and suddenly hundreds of downstream businesses are scrambling,” Miller said, in an email to The Register. “But when the target is an MSP, and the weapon is their own RMM software? That’s a whole new level of chaos. When DragonForce exploited SimpleHelp’s vulnerabilities, they didn’t just breach a single organization, they hijacked a distribution system.”

Sophos asserts with “medium confidence” that the DragonForce affiliate exploited a chain of vulnerabilities — all of which SimpleHelp patched in January — before deploying ransomware and exfiltrating sensitive data.

• Here’s what we know about the DragonForce ransomware that hit Marks & Spencer
• Ex-NSA bad-guy hunter listened to Scattered Spider’s fake help-desk calls: ‘Those guys are good’
• Ransomware attack on MATLAB dev MathWorks – licensing center still locked down
• Cybercrime is ‘orders of magnitude’ larger than state-backed ops, says ex-White House advisor

The three bugs are: Multiple path traversal vulnerabilities tracked as CVE-2024-57727, an arbitrary file upload vulnerability tracked as CVE-2024-57728, and a privilege escalation vulnerability tracked as CVE-2024-57726. Attackers can chain the flaws to fully hijack a SimpleHelp server.

In February, both the US and UK governments warned that attackers were actively exploiting these flaws.

The Sophos team also published a full list of indicators of compromise related to this investigation on GitHub, so we’d recommend checking those out. And if you haven’t already, apply the SimpleHelp software update. ®