U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a SimpleHelp flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SimpleHelp flaw, tracked as CVE-2026-48558 (CVSS score v3.1 of 10.0), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-48558 is a critical authentication bypass vulnerability in SimpleHelp versions 5.5.15 and earlier and 6.0 pre-release versions. When OIDC authentication is enabled, the software fails to verify the cryptographic signature of identity tokens, allowing a remote, unauthenticated attacker to forge a token and gain a fully authenticated technician session. In some configurations, the flaw can also bypass multi-factor authentication (MFA), with no user interaction required.

The researcher Zach Hanley (@hacks_zach) of Horizon3.ai discovered the vulnerability with the help of generative AI.

SimpleHelp is a remote support and remote access platform that organizations use to provide technical assistance, manage endpoints, and access computers over the internet. It is commonly deployed by IT departments, managed service providers (MSPs), and help desks to troubleshoot devices, transfer files, run remote commands, and perform system administration without being physically present.

Because SimpleHelp servers often provide privileged access to many customer systems, vulnerabilities in the platform can be particularly dangerous. If attackers compromise a SimpleHelp server, they may gain the same level of access as legitimate technicians, potentially allowing them to move laterally across networks, deploy malware, or steal sensitive data.

“The vulnerability identified affects servers configured to use either version of OIDC and is rooted in the way that SimpleHelp validates the IdP assertions. In many SimpleHelp deployments that have OIDC-type authentication enabled, an unauthenticated attacker can create and authenticate as a new “Technician” user. This Technician, by default, can perform privileged management activities such as remoting into managed endpoints, executing scripts, and more.” reads a technical analysis published by Hanley.

“Even when the SimpleHelp server is configured to enforce MFA for technicians, this issue allows the attacker to bypass this mechanism because on first login, technicians can self-register their own MFA method.”

The researcher pointed out that the flaw can be exploited only if OIDC authentication is enabled, an OIDC provider is linked to a TechnicianGroup, and the “Allow group authenticated logins” option is enabled. Researchers have withheld technical details but released indicators of compromise to help organizations detect potential exploitation.

BlackPoint researchers first observed attacks in the wild exploiting this vulnerability.

“The Adversary Pursuit Group identified two previously undiscovered malware samples, TaskWeaver and Djinn Stealer.” states the report published by BlackPoint. “The intrusion began with confirmed exploitation of CVE-2026-48558, allowing the attacker to bypass SimpleHelp OIDC authentication and obtain a technician session.”

Since January 2025, exposed SimpleHelp servers have risen from about 3,400 to nearly 14,000. Of those, around 7.2% were found configured with the vulnerable OIDC authentication method, according to the expert.

Hanley also published Indicators of Compromise (IoCs) for this attack.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on July 2nd, 2026.

In April, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two other SimpleHelp flaws to the KeV Catalog:

• CVE-2024-57726 SimpleHelp Missing Authorization Vulnerability
• CVE-2024-57728 SimpleHelp Path Traversal Vulnerability

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

A SimpleHelp authentication flaw is being exploited to deploy Djinn Stealer, a cross-platform malware targeting cloud, developer, and AI credentials.

The post SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux appeared first on TechRepublic.

Introduction

This blog is a focused update on the latest updates to the Ransomware Tool Matrix (RTM) and the Ransomware Vulnerability Matrix (RVM) covering three groups that I have published profiles for to help defenders home in on the threats most relevant to them: TheGentlemen, DragonForce, and WarLock.

Rather than write another broad ecosystem summary, the goal of this post is to introduce these profiles, briefly explain why each group matters right now, and give readers direct links to them so defenders can pivot straight into hunting, detection engineering, and patch prioritisation.

For anyone new to the projects, please read the descriptions on GitHub or feel free to watch my talk explaining the project at BSides London.

Why these three groups?

Each of the three groups added in this update represents a different slice of the current ransomware ecosystem:

TheGentlemen

TheGentlemen is a newer operation that has matured quickly, with a large and varied toolkit that reflects how cross-pollinated the affiliate ecosystem has become. The recent internal chat leak gave researchers a rare look into their tradecraft, and the profiles capture both the tooling and the exploited CVEs that have been observed across multiple intrusions. TheGentlemen’s RTM profile is here and RVM profile is here.

DragonForce

DragonForce has continued to escalate throughout 2025 and into 2026, branching into MSP-focused attacks and standing up its own "cartel" model that other affiliates can plug into. Its exploitation of edge devices (Ivanti, Fortinet, SonicWall) and SimpleHelp RMM make it a high-priority threat for any organisation using such systems. DragonForce’s RTM profile is here and RVM profile is here.

WarLock

WarLock jumped onto everyone's radar after the ToolShell SharePoint zero-day exploitation campaign, and has since been linked to a string of edge-application exploits including SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack. It is a strong example of a likely China-based operator that lives on zero-day exploitation of internet-facing software. WarLock’s RTM profile is here and RVM profile is here.

Observations and Trends

A few themes are worth flagging across all three profiles:

• BYOVD is now standard, not novel. All three groups have been observed bringing vulnerable drivers to disable or blind EDR. TheGentlemen with ThrottleStop driver, DragonForce with the TrueSight and Hangzhou Shunwang drivers, and WarLock with Antiy, NsecSoft, Rising, and VMTools drivers. If your detection stack is not yet hunting on or blocking suspicious driver loads and known-bad driver hashes, that is a high-priority gap to close.
• Network edge devices and other internet-facing systems remain the front door to victim networks for these groups. Fortinet, Ivanti, SonicWall, SimpleHelp, Microsoft SharePoint, SmarterMail, SolarWinds Web Help Desk, and Gladinet CentreStack all appear across these three profiles. Patch prioritisation that focuses on internet-exposed appliances and admin tooling continues to give defenders a valuable return on effort.
• Legitimate tooling continues to blur the line. Velociraptor, Cloudflared, VSCode Tunnels, AnyDesk, MeshCentral, FreeRDP, PuTTY, OpenSSH, and a long list of legitimate cloud services are all being repurposed for ransomware operations. Defender should use these lists to begin baselining what should exist in their environment and start alerting on the rest.

Conclusion

My recommendation for defenders remains the same as in previous updates: take the tools and CVEs from the RTM and RVM profiles and start threat hunting for their presence, writing detection rules to alert on certain behaviours, and blocking what is not expected or permitted in your environment. These three new profiles should make that easier to scope by group when you need to brief leadership, prioritise a hunt, or map your exposure to a specific campaign.

Here's a few sites that can help with turning the threat intel in these new profiles into detections:

- https://rulehound.com/rules

- https://detection.fyi

- https://www.snapattack.com/community

As always, feedback and pull requests are very welcome on both repos. Thanks to everyone who has contributed reports, corrections, and ideas. These projects only stay useful because the community keeps feeding them one way or another.