Incident Types: The types of cybersecurity incidents that have occurred include Ransomware.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with sophos rapid response engaged to contain and investigate the breach, and and third party assistance with zensec (investigation), and network segmentation with recommended (post-incident), and enhanced monitoring with recommended (rmm activity, unusual tool usage), and third party assistance with horizon3.ai (vulnerability research), third party assistance with sophos (incident analysis), and and containment measures with vendor patches for simplehelp vulnerabilities, containment measures with cisa kev catalog inclusion (cve-2024-57727), and remediation measures with apply simplehelp security updates, remediation measures with review rmm tool configurations, remediation measures with monitor for unauthorized access, and communication strategy with joint fbi/cisa advisory (may 2024), communication strategy with vendor notifications (simplehelp), and enhanced monitoring with recommended for rmm tools and connected environments..

Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through SimpleHelp remote management tool, Stolen CredentialsRDPVPNExploiting Vulnerabilities, Compromised SimpleHelp RMM Servers (Via CVE-2024-57726, CVE-2024-57727, CVE-2024-57728), SimpleHelp vulnerabilities (CVE-2024-57727 and others)ConnectWise ScreenConnect (historical)Rackspace (historical).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Host information, user data, and network configurations, Sensitive Data, User Files, Backup Credentials (Veeam), System Configuration Data, Potentially Pii and .

Third-Party Assistance: The company involves third-party assistance in incident response through Zensec (Investigation), , Horizon3.ai (vulnerability research), Sophos (incident analysis), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: apply SimpleHelp security updates, review RMM tool configurations, monitor for unauthorized access, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by sophos rapid response engaged to contain and investigate the breach, vendor patches for simplehelp vulnerabilities, cisa kev catalog inclusion (cve-2024-57727) and .

Key Lessons Learned: The key lessons learned from past incidents are 1. Supply-chain risks from trusted third-party tools (RMM) can bypass perimeter defenses. 2. Patch management failures enable exploitation of known vulnerabilities. 3. Legitimate IT tools (PDQ, AnyDesk) can be weaponized for lateral movement. 4. Backup systems (Veeam, Hyper-V) are high-value targets for credential harvesting. 5. Double extortion (encryption + leak sites) increases pressure on victims.RMM tools like SimpleHelp are high-value targets due to their broad access to client environments.,Prompt patching of vulnerabilities in remote support tools is critical to prevent supply chain attacks.,Initial access brokers (IABs) play a key role in facilitating ransomware attacks by selling access to compromised systems.,Cross-sector collaboration (e.g., FBI/CISA advisories) is essential for mitigating widespread threats.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Develop and test incident response plans for ransomware scenarios, including supply chain compromises., Audit third-party remote access tools (RMM) for vulnerabilities and misconfigurations., Secure backup credentials (e.g., Veeam) with encryption and access controls., Enhance monitoring for unusual activity in RMM tools (e.g., unexpected PDQ/AnyDesk usage)., Review and harden configurations of remote support tools to reduce attack surface., Educate employees and MSP clients on the risks of ransomware and phishing attacks., Deploy behavioral detection for tools like RClone/Restic in unusual contexts., Apply SimpleHelp security updates immediately to address CVE-2024-57727 and related vulnerabilities., Implement network segmentation to limit lateral movement from compromised RMM tools., Participate in information-sharing organizations (e.g., ISACs) for sector-specific threat intelligence., Monitor RMM tools for anomalous activity, such as unauthorized file downloads or lateral movement., Prepare for double extortion scenarios with incident response playbooks., Implement network segmentation to limit lateral movement from RMM servers., Restrict RMM tools to least-privilege access (avoid SYSTEM-level privileges by default). and Verify vendor patch status and prioritize updates for critical RMM software..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: SophosUrl: https://github.com/sophos/, and Source: FBI, Cybersecurity and Infrastructure Security Agency, and Australian Signals Directorate's Cyber Security CentreDate Accessed: 2023-06-04, and Source: Zensec Research Report, and Source: Medusa Leak Site, and Source: DragonForce Public Blog/Data Leak Site, and Source: Cybersecurity DiveDate Accessed: 2024-05-29, and Source: FBI/CISA Joint Advisory on Play RansomwareDate Accessed: 2024-05-29, and Source: Horizon3.ai Vulnerability Disclosure (SimpleHelp)Date Accessed: 2024-01, and Source: Sophos Incident Report (DragonForce Ransomware via SimpleHelp)Date Accessed: 2024-05, and Source: CISA Known Exploited Vulnerabilities (KEV) CatalogUrl: https://www.cisa.gov/known-exploited-vulnerabilities-catalogDate Accessed: 2024-02.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Joint Fbi/Cisa Advisory (May 2024) and Vendor Notifications (Simplehelp).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Fbi/Cisa Joint Advisory (May 2024), Health-Isac Recommendations For Healthcare Sector, Simplehelp Vendor Notifications, Msp-Specific Guidance From Cisa and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Zensec (Investigation), , Recommended (RMM Activity, Unusual Tool Usage), Horizon3.Ai (Vulnerability Research), Sophos (Incident Analysis), , Recommended for RMM tools and connected environments.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patching Vulnerabilities, Strengthening Credentials, Monitoring For Unusual Activity, , Mandate Patch Validation For Third-Party Rmm Tools., Enforce Least-Privilege Principles For Rmm Software., Isolate Rmm Servers In Segmented Networks., Monitor For Anomalous Use Of It Management Tools (Pdq, Anydesk)., Hardening Of Backup Systems (Veeam Credential Protection)., , Vendor Patches For Simplehelp Vulnerabilities, Enhanced Monitoring Of Rmm Tools By Msps, Updated Fbi/Cisa Guidance On Securing Remote Management Tools, Inclusion Of Cve-2024-57727 In Cisa Kev Catalog To Drive Patching, .

Last Attacking Group: The attacking group in the last incident were an DragonForce ransomware group, Play Ransomware Operators, Medusa Ransomware GroupDragonForce Ransomware-as-a-Service (RaaS) Group and Play Ransomware Gang (aka PlayCrypt).

Most Recent Incident Detected: The most recent incident detected was on 2025-01-22.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-05-29.

Most Significant Data Compromised: The most significant data compromised in an incident were Host information, user data, and network configurations, Sensitive Data, User Data (Files >1500 days old, <1500MB), Backup Infrastructure (Veeam Credentials, Hyper-V VHDX), High-Value Targets (Domain Controllers, File Servers) and .

Most Significant System Affected: The most significant system affected in an incident was SimpleHelp RMM ServersDownstream MSP Customer NetworksWindows EndpointsBackup Systems (Veeam)Hyper-V Virtual Machines and SimpleHelp remote support toolconnected client environments (via RMM compromise).

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was zensec (investigation), , horizon3.ai (vulnerability research), sophos (incident analysis), .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Sophos Rapid Response engaged to contain and investigate the breach and vendor patches for SimpleHelp vulnerabilitiesCISA KEV catalog inclusion (CVE-2024-57727).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Host information, user data, and network configurations, High-Value Targets (Domain Controllers, File Servers), Sensitive Data, User Data (Files >1500 days old, <1500MB), Backup Infrastructure (Veeam Credentials and Hyper-V VHDX).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Cross-sector collaboration (e.g., FBI/CISA advisories) is essential for mitigating widespread threats.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Develop and test incident response plans for ransomware scenarios, including supply chain compromises., Audit third-party remote access tools (RMM) for vulnerabilities and misconfigurations., Secure backup credentials (e.g., Veeam) with encryption and access controls., Enhance monitoring for unusual activity in RMM tools (e.g., unexpected PDQ/AnyDesk usage)., Review and harden configurations of remote support tools to reduce attack surface., Patch vulnerabilities, Educate employees and MSP clients on the risks of ransomware and phishing attacks., Use strong credentials, Deploy behavioral detection for tools like RClone/Restic in unusual contexts., Apply SimpleHelp security updates immediately to address CVE-2024-57727 and related vulnerabilities., Monitor for unusual activity, Implement network segmentation to limit lateral movement from compromised RMM tools., Participate in information-sharing organizations (e.g., ISACs) for sector-specific threat intelligence., Monitor RMM tools for anomalous activity, such as unauthorized file downloads or lateral movement., Prepare for double extortion scenarios with incident response playbooks., Implement network segmentation to limit lateral movement from RMM servers., Restrict RMM tools to least-privilege access (avoid SYSTEM-level privileges by default). and Verify vendor patch status and prioritize updates for critical RMM software..

Most Recent Source: The most recent source of information about an incident are Medusa Leak Site, DragonForce Public Blog/Data Leak Site, Horizon3.ai Vulnerability Disclosure (SimpleHelp), Cybersecurity Dive, FBI, Cybersecurity and Infrastructure Security Agency, and Australian Signals Directorate's Cyber Security Centre, Sophos Incident Report (DragonForce Ransomware via SimpleHelp), Sophos, CISA Known Exploited Vulnerabilities (KEV) Catalog, Zensec Research Report and FBI/CISA Joint Advisory on Play Ransomware.

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://github.com/sophos/, https://www.cisa.gov/known-exploited-vulnerabilities-catalog .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing investigation by Sophos Rapid Response.

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was FBI/CISA joint advisory (May 2024), Health-ISAC recommendations for healthcare sector, .

Most Recent Customer Advisory: The most recent customer advisory issued was an SimpleHelp vendor notificationsMSP-specific guidance from CISA.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an SimpleHelp remote management tool, Compromised SimpleHelp RMM Servers (Via CVE-2024-57726, CVE-2024-57727 and CVE-2024-57728).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Vulnerabilities in SimpleHelp remote management tool, Exploiting VulnerabilitiesUsing Stolen CredentialsRemote Access Tools, Unpatched SimpleHelp RMM vulnerabilities despite available fixes.Overprivileged RMM tools (SYSTEM-level access by default).Trust in legitimate management channels (MSP tools bypassing security controls).Insufficient segmentation between MSP and customer networks., Unpatched vulnerabilities in SimpleHelp (CVE-2024-57727 and others)Inadequate security controls for RMM tools (historical pattern)Effective exploitation of supply chain trust relationships.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Patching vulnerabilitiesStrengthening credentialsMonitoring for unusual activity, Mandate patch validation for third-party RMM tools.Enforce least-privilege principles for RMM software.Isolate RMM servers in segmented networks.Monitor for anomalous use of IT management tools (PDQ, AnyDesk).Hardening of backup systems (Veeam credential protection)., Vendor patches for SimpleHelp vulnerabilitiesEnhanced monitoring of RMM tools by MSPsUpdated FBI/CISA guidance on securing remote management toolsInclusion of CVE-2024-57727 in CISA KEV catalog to drive patching.