DRAGONFORCE

How does prediction work?

Predicted CVEs are identified through automated correlation using multiple sources: vendor/product profiles historically targeted by the group (MITRE ATT&CK), attack chain patterns (KEV + TTPs), threat intelligence (MISP, STIX), and AI analysis. These CVEs have not been confirmed as exploited by this specific group, but have a high probability of being targets based on the actor's operational profile.

CVE-2026-48558 CRITICAL SimpleHelp predicted 10.0 CVE-2024-57726 CRITICAL SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. high 9.9 CVE-2024-57726 CRITICAL SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. predicted 9.9 CVE-2024-57727 HIGH SimpleHelp SimpleHelp predicted 7.5 CVE-2024-57727 HIGH SimpleHelp SimpleHelp high 7.5 CVE-2024-57728 HIGH SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. high 7.2 CVE-2024-57728 HIGH SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. predicted 7.2

T1204.002 User Execution Execution T1070.004 Indicator Removal: File Deletion Defense Evasion T1562.001 Impair Defenses: Disable or Modify Tools Defense Evasion T1083 File and Directory Discovery Discovery T1486 Data Encrypted for Impact Impact