SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.
Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.
The Play ransomware group has been active since June 2022, targeting businesses and critical infrastructure in North America, South America, and Europe. They gain access by exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. Their attacks follow a double extortion model, encrypting systems after exfiltrating data using AES-RSA hybrid encryption. The group employs various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement multifactor authentication, regular patching, network segmentation, and maintain offline backups to reduce risk.
