MSPs on Alert: DragonForce Ransomware, ScreenConnect Abuse, and Microsoft’s Update Integration

DragonForce has emerged as a significant threat actor in the cybercrime landscape, targeting vulnerabilities in the SimpleHelp remote monitoring and management tool to execute sophisticated ransomware-as-a-service attacks against managed service providers (MSPs). Recent incidents have highlighted how attackers exploited known vulnerabilities, including path traversal and privilege escalation issues, to deploy DragonForce ransomware, which involved exfiltrating sensitive data and employing double extortion tactics. While some clients were protected by endpoint security measures, others suffered significant impacts, underscoring the importance of maintaining IT hygiene and patch management.The rise of DragonForce is indicative of a broader trend where low-key remote monitoring and management vendors become high-risk entry points for cybercriminals. The evolution of DragonForce from disruptive ransomware player to a full-blown ransomware-as-a-service operator executing targeted extortion campaigns raises alarms about the security of tools widely used by small and medium-sized businesses (SMBs). This situation serves as a reminder that disclosed vulnerabilities can become weaponized if organizations fail to prioritize patching and security measures.In another concerning development, ConnectWise's ScreenConnect has been identified as the most abused legitimate remote access tool in cyberattacks, accounting for a significant percentage of active threat reports. Cybercriminals are hijacking these tools, typically used by IT professionals, to infiltrate systems and deliver malicious software. The increasing popularity of ScreenConnect has raised vendor trust concerns among IT service providers, prompting discussions about the implications of using such tools in an environment where they can be misused, even without technical exploits.Microsoft is also making waves in the patch management landscape by introducing a Windows Update Orchestration platform that allows app developers to integrate their update processes into the Windows 11 framework. This initiative aims to create a unified system for managing updates across devices, addressing user concerns about fragmented experiences. The implications of this change are profound, as it positions Microsoft as a central authority in the software update lifecycle, potentially reshaping how managed service providers and security teams approach patching and update management in the future.  Four things to know today00:00 DragonForce Targets SimpleHelp Vulnerabilities in MSP-Focused Ransomware Campaign03:30 ConnectWise ScreenConnect Now the Most Abused Remote Access Tool in 2025 Cyberattacks, Report Finds05:56 Unified Patch Control: Microsoft’s Update Orchestration Platform Threatens RMM Value Propositions08:55 Actionable AI: Governance Framework and MCP Protocol Deliver Real-World Benefits Amid Hype  This is the Business of Tech.     Supported by:  https://syncromsp.com/  💼 All Our SponsorsMSP Radio is supported by our partners: LogMeIn · Opentext · Transit AI · Guardz · Pax8 · ABC Solutions · Rythmz · ScalePad · CometBackup · TimeZest Supporting the IT services community through insights, analysis, and transparency. 🚀 Join Business of Tech PlusGet exclusive access to investigative reports, vendor analysis, leadership briefings, and more.👉 https://businessof.tech/plus 🎧 Subscribe to the Business of TechWant the show on your favorite podcast app or prefer the written versions of each story?📲 https://www.businessof.tech/subscribe 📰 Story Links & SourcesLooking for the links from today’s stories?Every episode script — with full source links — is posted at:🌐 https://www.businessof.tech 🎙 Want to Be a Guest?Pitch your story or appear on Business of Tech: Daily 10-Minute IT Services Insights:💬 https://www.podmatch.com/hostdetailpreview/businessoftech 🔗 Follow Business of Tech LinkedIn: https://www.linkedin.com/company/28908079YouTube: https://youtube.com/mspradioBluesky: https://bsky.app/profile/businessof.techInstagram: https://www.instagram.com/mspradioTikTok: https://www.tiktok.com/@businessoftechFacebook: https://www.facebook.com/mspradionews Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.