MSP Nightmare: Medusa & DragonForce Exploit SimpleHelp RMM Flaws for SYSTEM Access

A new Zensec report highlights a critical supply-chain risk in the IT sector, detailing how two Ransomware-as-a-Service groups, Medusa and DragonForce, are actively exploiting unpatched SimpleHelp RMM vulnerabilities to gain SYSTEM-level access. The campaigns, observed in early and mid-2025, leveraged CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728 to pivot from compromised MSPs into victim networks with minimal friction.

Medusa operators used PDQ Inventory and PDQ Deploy to push ransomware payloads such as Gaze.exe or REDACTED.exe, often deploying base64-encoded PowerShell commands that disabled or altered Microsoft Defender and added Defender exclusions.

DragonForce followed a similar intrusion vector, establishing persistence with AnyDesk and new local admin accounts, and exfiltrating data via Restic to Wasabi cloud storage, with encrypted files bearing the extension “.dragonforce_encrypted” and ransom notes instructing victims to contact the group via TOX ID.

Zensec notes the activity aligns with a double-extortion model and urges immediate patching of SimpleHelp servers, along with strict access controls and thorough monitoring of RMM telemetry and unusual outbound transfers.