They Used the Tool the Provider Used to Manage Everyone

The DragonForce ransomware operation breached a managed service provider and used its SimpleHelp remote monitoring and management platform to steal data and deploy encryptors on downstream customer systems. Investigators assess that a chain of vulnerabilities tracked as CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728 was used to reach the provider.

This desk filed at 25-0612b that a third of small businesses could not absorb a $10,000 loss, and at 25-0616b that what such organisations need is not an obligation but capability they cannot build.

A managed service provider is that capability. It gives a twenty-person firm patching, monitoring, backup and a helpdesk it could never staff — genuinely better security than the alternative, which is nothing.

It also gives one organisation administrative access to every customer at once. The corpus has recorded this trade repeatedly — a shared platform gives a small district professional-grade software it could never build, at 25-0105 — and here the second half arrived.

Ground-station links at 25-0623. A support portal at 25-0105. A backup service holding every customer’s firewall configuration at 25-0917. An integration reaching seven hundred environments at 25-0818. Connected applications at 25-1121b.

Each is the mechanism by which a small team operates a large estate, and each concentrates reach accordingly. An RMM platform is the purest example: its entire purpose is executing commands on other people’s computers.

CVE-2024-57726, -57727 and -57728, exploited in 2025. This desk drew the distinction at 25-1107b between zero-days, where the customer could do nothing, and known defects with available fixes.

This is the second category, and it lands on an organisation whose product is keeping other people patched.