Ransomware Operators Exploit RMM Tools to Deploy Medusa and DragonForce

Cybersecurity researchers have exposed a supply-chain style campaign where trusted RMM infrastructure was abused to deploy Medusa and DragonForce ransomware across multiple UK organisations in early 2025.

The investigation, according to Zensec, shows two prominent ransomware-as-a-service groups exploiting three vulnerabilities in SimpleHelp RMM (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728) to breach downstream customers via MSPs, with patches having been released but many organisations still compromised in Q1 and Q2 2025.

Medusa operators used PDQ Inventory and PDQ Deploy to push the ransomware, deploying payloads named “Gaze.exe” or organisation-specific executables, and employed base64-encoded PowerShell commands to disable Microsoft Defender and set exclusions. The ransomware encrypted systems with the “.MEDUSA” extension and used a data-leak site for double-extortion, including proof-of-life packs and browsable file trees.

DragonForce, established in 2023, mirrored the initial access via compromised SimpleHelp instances but installed AnyDesk for interactive control and created local administrator accounts named “admin” to persist, with exfiltration favouring Restic to Wasabi storage and targeting Veeam credentials and backups.

The campaign underscores that organisations remain as secure as their least-protected vendor, urging audits of third-party remote tools, patch status verification, network segmentation, and heightened monitoring of RMM activity.