Feb 21, 2024
2 new incidents, 1 with updates.
Started
- ClosedCriticalNo fix needed
Change Healthcare ransomware attack (ALPHV/BlackCat)
The ALPHV/BlackCat ransomware gang got into UnitedHealth's Change Healthcare on 2024-02-12 using stolen credentials for a Citrix remote-access portal without multi-factor authentication, then deployed ransomware on 2024-02-21. Claims processing and pharmacy payments across the US health system were disrupted for weeks. By October 2024 Change Healthcare had sent about 100 million notices to individuals (later estimates were about 190 million people).
Change Healthcare (UnitedHealth Group / Optum)Closed Oct 22, 2024
- ClosedPatched
Progress Kemp LoadMaster OS Command Injection
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Added to the CISA KEV catalog on 2024-11-18.
Progress Kemp LoadMasterClosed Nov 18, 2024
Updated
- ClosedPatched
ConnectWise ScreenConnect auth bypass mass-exploited
ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.
ConnectWise ScreenConnectClosed Feb 22, 2024
