Log in Request a demo

Threat Intelligence Researches

Remote support and file transfer flaws in ransomware attacks

SimpleHelp, CrushFTP, GoAnywhere and BeyondTrust flaws were flagged by CISA for ransomware use in 2025 and 2026. Dates, fixes, attribution and checks.

4 Min Read

Four flaws in remote support and file transfer software were added to the CISA Known Exploited Vulnerabilities (KEV) catalog in 2025 and 2026 with the flag “known ransomware campaign use”: SimpleHelp, CrushFTP, Fortra GoAnywhere and BeyondTrust. These tools are built to reach many systems or hold many files, and each is usually open to the internet. Here are the dates, who CISA says used them and what to check.

Which remote support and file transfer flaws were flagged?

CVE-2024-57727 is a path traversal flaw in SimpleHelp remote support software: a crafted web request can reach files outside the folders meant to be public. CVE-2025-31161 lets an outsider sign in to the CrushFTP file transfer server as a known user, such as the built-in crushadmin account. CVE-2025-10035 is a deserialization flaw in the License Servlet of Fortra GoAnywhere MFT, a managed file transfer product. CVE-2026-1731 is a command injection flaw in BeyondTrust Remote Support and some older Privileged Remote Access versions, exploitable with no login.

Four flaws, four KEV listings
  1. 13 Feb 2025SimpleHelp, CVE-2024-57727CISA adds it to KEV. In June 2025 CISA says ransomware actors have used unpatched SimpleHelp since January 2025.
  2. 7 Apr 2025CrushFTP, CVE-2025-31161CISA adds it to KEV. CrushFTP shipped fixed builds on 21 March 2025, and NVD says it was exploited in March and April 2025.
  3. 29 Sep 2025GoAnywhere MFT, CVE-2025-10035CISA adds it to KEV. Fortra’s advisory gives a discovery date of 11 September 2025.
  4. 13 Feb 2026BeyondTrust, CVE-2026-1731CISA adds it to KEV a week after NVD published it, with a three day deadline for US federal agencies.
  5. 24 Apr 2026SimpleHelp siblingsCISA adds CVE-2024-57726 and CVE-2024-57728, also flagged for ransomware use.

Who exploited them?

Two sources name ransomware groups. The CISA, FBI and MS-ISAC #StopRansomware advisory on Medusa, updated on 18 August 2026, lists CVE-2025-10035 in GoAnywhere and CVE-2026-1731 in BeyondTrust among the flaws Medusa actors exploit. The #StopRansomware advisory on Play, from CISA, the FBI and the Australian Signals Directorate’s ACSC, says multiple ransomware groups, including initial access brokers with ties to Play operators, exploited the SimpleHelp flaw. The CISA alert on SimpleHelp (AA25-163A, 12 June 2025) says only “ransomware actors” and describes double extortion against the customers of a utility billing software provider. The official sources opened here name no actor for CrushFTP.

Warning: A provider's flaw becomes its customers' flawWith SimpleHelp, CISA says ransomware actors likely used the flaw to reach the customers of a utility billing software provider. A service provider running one of these tools should tell downstream customers to check their own systems.

Which versions fix them?

  • SimpleHelp: 5.5.8 or later. Patches exist for 5.4.10 and 5.3.9.
  • CrushFTP: 11.3.4_23 or later on version 11, or 10.8.5 or later on version 10, as the vendor says. The Canadian Cyber Centre named 10.8.4 and 11.3.1 or later.
  • GoAnywhere MFT: 7.8.4, or the Sustain Release 7.6.3.
  • BeyondTrust: NVD lists Remote Support before 25.3.2 and Privileged Remote Access before 25.1 as affected. Check the vendor advisory for the exact fixed builds.

What should you check on your own servers?

Treat any of these four products that faces the internet as a first priority. The steps below come from the vendors and CISA guidance for these flaws.

Checks for remote support and file transfer servers
  1. Patch and shut the admin doorUpdate to the fixed builds. Fortra says to make sure the GoAnywhere Admin Console is not open to the public.
  2. Reset credentialsFor SimpleHelp, change administrator and technician passwords, since the configuration file may have leaked.
  3. Look for known tracesGoAnywhere: search logs for errors containing SignedObject.getObject. CrushFTP: unexpected sign-ins to crushadmin, new admin users, odd file downloads since March 2025.
  4. Check downstreamService providers should tell customers to check their endpoints, as CISA advises for SimpleHelp.
  5. Assume exposure for BeyondTrustCISA asks owners to check all internet-facing BeyondTrust products for signs of compromise.

How can monitoring help?

These flaws moved from disclosure to KEV listing in days or weeks, and the BeyondTrust deadline was three days. A list of every remote support and file transfer tool you run, with an owner for each, is the first control. Threat intelligence monitoring can add alerts when advisories or exploitation reports name one of your products, and when credentials tied to these admin consoles show up for sale. It does not replace patching.

Last checked against sources on 9 October 2026.

Frequently Asked Questions.

Which remote support tools were exploited by ransomware actors?

SimpleHelp (CVE-2024-57727) and BeyondTrust Remote Support (CVE-2026-1731) are in CISA KEV with the ransomware use flag. CISA says Medusa actors exploit the BeyondTrust flaw.

Which ransomware group exploits GoAnywhere CVE-2025-10035?

The CISA, FBI and MS-ISAC advisory on Medusa, updated on 18 August 2026, lists it among the flaws Medusa actors exploit.

What is the fixed version of SimpleHelp?

SimpleHelp 5.5.8 or later. The vendor also has patches for 5.4.10 and 5.3.9.

How do I check GoAnywhere for exploitation?

Fortra says to search the logs for errors containing SignedObject.getObject in a stack trace. If the string is present, the instance was likely affected.

Sources

  1. 1 CISA AA25-163A: Ransomware actors exploit unpatched SimpleHelp RMM
  2. 2 CISA #StopRansomware: Medusa ransomware (AA25-071A)
  3. 3 CISA #StopRansomware: Play ransomware (AA23-352A)
  4. 4 Canadian Centre for Cyber Security alert on CrushFTP
  5. 5 NVD record for CVE-2025-31161
  6. 6 CISA Known Exploited Vulnerabilities catalog
Share

In This Article

Ransomware groupsMedusa VulnerabilitiesSimpleHelp path traversal (CVE-2024-57727) VulnerabilitiesCrushFTP authentication bypass (CVE-2025-31161) VulnerabilitiesGoAnywhere MFT License Servlet flaw (CVE-2025-10035) VulnerabilitiesBeyondTrust Remote Support and PRA command injection (CVE-2026-1731) TermsKnown Exploited Vulnerabilities (KEV) catalog TermsRansomware TermsInitial access broker

Where To Next.

All Threat Intelligence Researches Articles
In plain words · Glossary term Known Exploited Vulnerabilities (KEV) catalog The Known Exploited Vulnerabilities (KEV) catalog is a list of vulnerabilities that have been exploited in real attacks. Open → Keep reading · Article Five edge VPN flaws CISA flags for ransomware use Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check… Open → Keep reading · Article Two Fortinet events of 2026: what to check Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from… Open →

Knowledge HubRansomware groups