ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
connectwise screenconnect |
ScreenConnect flaws exploited to drop new ToddleShark malware By Bill Toulas March 4, 2024 05:14 PM 0 The North Korean APT hacking group Kimsuky is exploiting ScreenConnect flaws, particularly CVE-2024-1708 and CVE-2024-1709, to infect targets with a new malware variant dubbed ToddleShark. Kimsuky (aka Thallium and Velvet Chollima) is a North Korean state-sponsored hacking group known for cyber espionage attacks on organizations and governments worldwide. The threat actors are exploiting authent...
ScreenConnect flaws exploited to drop new ToddlerShark malware By Bill Toulas March 4, 2024 05:14 PM 0 The North Korean APT hacking group Kimsuky is exploiting ScreenConnect flaws, particularly CVE-2024-1708 and CVE-2024-1709, to infect targets with a new malware variant dubbed ToddlerShark. Kimsuky (aka Thallium and Velvet Chollima) is a North Korean state-sponsored hacking group known for cyber espionage attacks on organizations and governments worldwide. The threat actors are exploiting authe...
Ransomware gang claims they stole 6TB of Change Healthcare data By Sergiu Gatlan February 28, 2024 02:33 PM 0 The BlackCat/ALPHV ransomware gang has officially claimed responsibility for a cyberattack on Optum, a subsidiary of UnitedHealth Group (UHG), which led to an ongoing outage affecting the Change Healthcare platform. Change Healthcare is the largest payment exchange platform used by more than 70,000 pharmacies across the United States. UHG is the world's largest healthcare company by reve...
FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks By Sergiu Gatlan February 27, 2024 05:26 PM 0 Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks. "ALPHV Blackcat affiliates have been observed primarily targeting the healthcare sector," the joint advisory cautions. Today's warning follows an April 2022 FBI flash alert and another advisory issued in December 2023 detailin...
Black Basta, Bl00dy ransomware gangs join ScreenConnect attacks By Sergiu Gatlan February 27, 2024 01:53 PM 0 The Black Basta and Bl00dy ransomware gangs have joined widespread attacks targeting ScreenConnect servers unpatched against a maximum severity authentication bypass vulnerability. This critical flaw (CVE-2024-1709) allows attackers to create admin accounts on Internet-exposed servers, delete all other users, and take over any vulnerable instance. CVE-2024-1709 has been under active expl...
UnitedHealth subsidiary Optum hack linked to BlackCat ransomware By Sergiu Gatlan February 26, 2024 07:13 PM 0 A cyberattack on UnitedHealth Group subsidiary Optum that led to an ongoing outage impacting the Change Healthcare payment exchange platform was linked to the BlackCat ransomware group by sources familiar with the investigation. Change Healthcare warned customers on Wednesday that some of its services are offline because of a cybersecurity incident. One day later, UnitedHealth...
ScreenConnect servers hacked in LockBit ransomware attacks By Sergiu Gatlan February 22, 2024 01:34 PM 0 Attackers are exploiting a maximum severity authentication bypass vulnerability to breach unpatched ScreenConnect servers and deploy LockBit ransomware payloads on compromised networks. The maximum severity CVE-2024-1709 auth bypass flaw has been under active exploitation since Tuesday, one day after ConnectWise released security updates and several cybersecurity companies published proof-of-...
New ScreenConnect RCE flaw exploited in ransomware attacks By Sergiu Gatlan February 22, 2024 01:34 PM 0 Update February 23, 07:02 EST: Sophos published a report today saying that the ransomware payloads they spotted were built using the LockBit ransomware builder leaked online by a disgruntled malware developer in late September 2022. The samples seen by Sophos in this week's attacks were a buhtiRansom LockBit variant dropped on 30 different customer networks and a second payload...
ScreenConnect critical bug now under attack as exploit code emerges By Bill Toulas February 21, 2024 12:18 PM 0 Both technical details and proof-of-concept exploits are available for the two vulnerabilities ConnectWise disclosed earlier this week for ScreenConnect, its remote desktop and access software. A day after the vendor published the security issues, attackers started leveraging them in attacks. CISA has assigned CVE-2024-1708 and CVE-2024-1709 identifiers to the the two security issues, ...
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Crew may well be working under contract for Beijing
Chinese spies exploited a couple of critical-severity bugs in F5 and ConnectWise equipment earlier this year to sell access to compromised US defense organizations, UK government agencies, and hundreds of other entities, according to Mandiant. The Google-owned threat hunters said they assess, "with moderate confidence," that a crew they track as UNC5174 was behind the exploitation of CVE-2023-46747, a 9.8-out-of-10-CVSS-rated remote code execution bug in the F5 BIG-IP Traffic Management User Int...
Vulmon