Ransomware scum disrupted utility services with SimpleHelp attacks

Ransomware criminals infected a utility billing software providers’ customers, and in some cases disrupted services, after exploiting unpatched versions of SimpleHelp’s remote monitoring and management (RMM) tool, according to a Thursday CISA alert.

“This incident is part of a broader trend of ransomware actors exploiting unpatched versions of SimpleHelp RMM since January 2025,” the security advisory warned. “Ransomware actors likely exploited CVE-2024-57727 to access downstream customers’ unpatched SimpleHelp RMM, resulting in service disruptions and double extortion incidents.”