The American Hospital Association (AHA) along with the Health Information Sharing and Analysis Center (Health-ISAC) released a cybersecurity alert concerning three vulnerabilities identified in the SimpleHelp Remote Monitoring and Management (RMM) software that are thought to be actively exploited. Healthcare providers were instructed to implement patches for the vulnerabilities immediately.
Researchers at Horizon3 identified the vulnerabilities in December 2024 and advised SimpleHelp on January 6, 2025. On January 13, 2025, the vulnerabilities were announced to the public along with the release of patches to resolve the vulnerabilities. One week after the announcement, threat actors are believed to have begun vulnerability exploitation. Researchers at Arctic Wolf noticed malicious activity on January 22, 2024. Although there is no confirmation that the intrusion on vulnerable SimpleHelp servers took advantage of these particular vulnerabilities, the timing seems to point to these vulnerabilities as the probable source of the attacks. Arctic Wolf states that the attackers gathered network intelligence, a preliminary to privilege escalation and lateral movement; nevertheless, the malicious session was ended before the observation of further actions.
The vulnerability CVE-2024-57726 is a privilege escalation vulnerability with a CVSS score of 9.9. Vulnerability CVE-2024-57727 is a directory traversal vulnerability with a CVSS score of 7.5). Vulnerability CVE-2024-57728 is a path traversal vulnerability with a CVSS score of 7.2. Threat actors that succeed in exploiting the vulnerabilities could upload and download files, read, alter, and delete information, elevate privileges to the admin level, and implement arbitrary code.
About 580 SimpleHelp servers are compromised online, the majority of which are based in the United States. The vulnerabilities impacted SimpleHelp versions 5.3, 5.4, and 5.5 and were resolved in versions 5.3.9, 5.4.10, and 5.5.8. Because the vulnerabilities are likely to be actively exploited, software must be upgraded to the most recent version immediately and employees must receive updated HIPAA training. Investigations must also be done to find out when the vulnerabilities were exploited.
