Loading story…
Arctic Wolf observed a campaign beginning January 22, 2025, in which attackers used unauthorized access to devices running SimpleHelp remote monitoring and management (RMM) software for initial access. An existing SimpleHelp client connected to an unapproved server, and attackers enumerated accounts and domain information before the session was terminated. The activity followed Horizon3’s disclosure of CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728, but Arctic Wolf did not confirm that those vulnerabilities enabled the campaign.
SimpleHelp published a security advisory covering vulnerabilities in version 5.5.7 and earlier. Organizations should upgrade SimpleHelp servers to fixed versions, remove unused clients, rotate administrator and Technician passwords, and restrict login source IP addresses. Security teams should also investigate client connections to unapproved SimpleHelp servers and associated account or domain enumeration, rather than assuming that patching alone addresses unauthorized access.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Arctic Wolf began observing attackers using unauthorized access to devices running SimpleHelp as an initial access vector. Existing clients connected to an unapproved SimpleHelp server, and attackers used cmd.exe, net, and nltest to enumerate accounts and domain information; exploitation of the disclosed vulnerabilities was not confirmed.
Arctic Wolf recommended upgrading to fixed SimpleHelp versions 5.5.8, 5.4.10, or 5.3.9 and removing unnecessary clients left by third-party support sessions. The bulletin also relayed SimpleHelp's recommendations to rotate administrator and Technician passwords and restrict login source IP addresses.
The SimpleHelp session was terminated after the attackers performed account and domain enumeration. Arctic Wolf did not observe the attackers progressing to their objectives.
Horizon3 publicly disclosed CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 roughly one week before the observed campaign emerged. The vulnerabilities could allow arbitrary file downloads, administrative file uploads, and privilege escalation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SimpleHelp released fixes for three **critical** vulnerabilities in its remote support and RMM software that can be chained to gain full control of vulnerable servers. The flaws are tracked as `CVE-2024-57726`, an authorization weakness that allows privilege escalation to administrator; `CVE-2024-57727`, an unauthenticated arbitrary file download issue that can expose sensitive data and credentials; and `CVE-2024-57728`, an authenticated administrator file upload flaw that can lead to remote code execution. Horizon3.ai disclosed the issues, and affected versions include SimpleHelp `5.5` before `5.5.8`, `5.4` before `5.4.10`, and `5.3` before `5.3.9`. CSIRT.SK reported that attackers have already targeted exposed SimpleHelp RMM systems, with Arctic Wolf observing intrusions in which threat actors used leaked credentials or exploited the vulnerabilities for initial access and compromise. The vendor urged organizations to patch immediately, rotate administrator and technician passwords, and restrict those account logins to trusted IP addresses to reduce the risk of server takeover and downstream compromise of managed endpoints.
Jul 24, 2026
Attackers are actively exploiting **CVE-2026-48558**, a maximum-severity authentication bypass in **SimpleHelp** RMM, to forge OpenID Connect identity tokens and obtain fully authenticated **technician sessions** on exposed servers. The flaw affects deployments using generic OIDC or Azure AD OIDC because SimpleHelp accepted identity tokens without validating their cryptographic signatures, enabling unauthenticated access and, in some cases, bypass of MFA during technician enrollment. The issue affects **SimpleHelp 5.5.1 through 5.5.15** and **6.0 pre-release builds before 6.0 RC2**, and has been patched in **5.5.16+** and **6.0 RC2+**. In observed intrusions, attackers abused the trusted RMM channel to transfer files and execute commands across managed endpoints, deploying the obfuscated **TaskWeaver** Node.js loader followed by the newly identified **Djinn Stealer** malware. Reporting says TaskWeaver fetched additional payloads and used encrypted communications, while Djinn Stealer harvested credentials and sensitive data from browsers, cloud platforms, developer and package registry tooling, SSH environments, AI tools, and cryptocurrency wallets across **Windows, macOS, and Linux** before exfiltration. **CISA** added the flaw to its **Known Exploited Vulnerabilities** catalog, and sector alerts warned that compromise of a SimpleHelp server could give attackers downstream access across MSP and utility environments, increasing the risk of lateral movement, credential theft, and ransomware deployment.
Jul 6, 2026
Researchers disclosed **CVE-2026-48558**, a maximum-severity authentication bypass in SimpleHelp remote management software that allows unauthenticated attackers to forge OpenID Connect identity tokens and log in as a technician. The flaw affects SimpleHelp `5.5.15` and earlier, along with `6.0` pre-release versions, because the OIDC login flow accepts submitted JWT identity tokens without verifying their cryptographic signature. The issue is rated `CVSS 10.0` and mapped to `CWE-347`, with no user interaction required for exploitation. Successful exploitation can give attackers an authenticated technician session with administrative reach into managed environments, including remote access to endpoints, script execution, and in some cases **MFA bypass** because technician accounts can enroll their own MFA method at first login. Horizon3.ai said the bug affects deployments using generic OIDC and Azure Active Directory OIDC, and estimated that internet-exposed SimpleHelp servers have grown to nearly **14,000**, with about **7.2%** using the vulnerable configuration. Defenders were urged to apply vendor patches immediately, restrict technician authentication by IP where patching is delayed, and review technician accounts and server logs for signs of compromise.
Jul 2, 2026