Threat Actors Exploit SimpleHelp Vulnerabilities to Deploy Sliver Backdoor

Summary: Cybersecurity firm Field Effect successfully thwarted a cyberattack exploiting vulnerabilities in SimpleHelp’s Remote Monitoring and Management software. The attackers utilized the Sliver backdoor to infiltrate networks and executed several post-compromise tactics, which could have led to ransomware deployment had the attack not been detected and mitigated. This incident highlights the emerging threats associated with RMM tools and the importance of robust cybersecurity measures.

Affected: SimpleHelp RMM Software

Keypoints :

Field Effect’s detection led to isolation of the compromised endpoint before escalation could occur.
Attackers used privilege escalation techniques and established persistence mechanisms through a binary consistent with the Sliver framework.
The threat actor’s activity is reminiscent of tactics associated with the Akira Ransomware group, indicating potential coordinated responses to SimpleHelp vulnerabilities.

Source: https://securityonline.info/threat-actors-exploit-simplehelp-vulnerabilities-to-deploy-sliver-backdoor/

Tags: BACKDOOR, EXPLOIT, PERSISTENCE, FIREWALL, MDR, TOOL, PRIVILEGE, RECONNAISSANCE