The DragonForce ransomware operation has rapidly emerged as a significant threat actor by exploiting three (3) critical vulnerabilities in the SimpleHelp remote monitoring and management (RMM) platform (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728) to breach a Managed Service Provider (MSP) and launch downstream attacks on its customers. Sophos, which investigated the incident, found that DragonForce leveraged the MSP’s legitimate SimpleHelp infrastructure to perform reconnaissance, exfiltrate data, and deploy ransomware encryptors, resulting in double-extortion attacks. While one client successfully blocked the intrusion, others experienced a widespread impact, with stolen data and encrypted systems. This attack highlights the increasing threat posed by ransomware groups targeting MSP supply chains to achieve broad reach. DragonForce, already notorious for recent high-profile attacks on UK retailers such as Marks & Spencer and Co-op, is positioning itself as a ransomware “cartel” by offering a white-label ransomware-as-a-service (RaaS) model, enabling affiliates to rebrand its encryptor. The group’s rise has coincided with a volatile ransomware ecosystem marked by turf wars, the collapse and partial resurgence of LockBit, and growing collaboration with other cybercriminal factions like Scattered Spider, which may act as access brokers. These developments signal a shift toward more decentralized, affiliate-driven ransomware operations that increasingly leverage social engineering tactics, remote access tools, and AI to sustain stealthy, scalable attacks. CTIX analysts will continue to report on the exploitation of vulnerabilities by threat actors in the future.