SmarterTools Breach via Unpatched SmarterMail Server Leading to Warlock Ransomware Attempt

SmarterTools confirmed it was breached after attackers exploited an unpatched instance of its SmarterMail email server inside the company’s environment. COO Derek Curtis said the intrusion occurred on January 29, 2026, when an employee-created VM running SmarterMail was not being updated; attackers used it as an entry point, then moved laterally across roughly 30 SmarterMail servers/VMs spanning the office network and a datacenter used for quality-control labs. The incident disrupted the company’s Portal support center, but SmarterTools said segmentation limited broader impact and that security tooling blocked the ransomware encryption attempt.

Reporting attributes the activity to the Warlock ransomware operation (also linked in some tracking to Gold Salem). SmarterTools did not publicly name the exploited flaw, but coverage points to CVE-2026-24423—a SmarterMail authentication bypass that can enable admin password resets—as the most likely initial vector; it was disclosed by watchTowr Labs, patched on January 15, and later added to CISA KEV with an “Exploited in ransomware attacks” designation. SmarterTools stated that only a subset of Windows systems appeared impacted (with Linux servers unaffected), and that business applications/account data were not compromised; post-incident actions included removing Windows from networks, discontinuing Active Directory, restoring some systems from recent backups, and rotating passwords.