A week in security (July 4 – July 10)

Last week on Malwarebytes Labs: My Body, My Data Act would lock down reproductive and sexual health data "Free UK visa" offers on WhatsApp are fakes HackerOne insider fired for trying to claim other people’s bounties Update now! Chrome patches ANOTHER zero-day vulnerability Cloud-based malware is...

North Korean APT targets US healthcare sector with Maui ransomware

State-sponsored North Korean threat actors have been targeting the US Healthcare and Public Health HPH sector for the past year using the Maui ransomware, according to a joint cybersecurity advisory CSA from the FBI, Cybersecurity and Infrastructure Security Agency CISA, and the Department of the...

U.S. Healthcare Orgs Targeted with Maui Ransomware

Several federal agencies are warning healthcare organizations that they are under threat of attacks from North Korean state-sponsored actors employing a unique ransomware that targets files with surgical precision, according to U.S. federal authorities. Threat actors from North Korea have been...

North Korean Maui Ransomware Actively Targeting U.S. Healthcare Organizations

In a new joint cybersecurity advisory, U.S. cybersecurity and intelligence agencies have warned about the use of Maui ransomware by North Korean government-backed hackers to target the healthcare sector since at least May 2021. "North Korean state-sponsored cyber actors used Maui ransomware in...

North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

Summary The Federal Bureau of Investigation FBI, Cybersecurity and Infrastructure Security Agency CISA, and the Department of the Treasury Treasury are releasing this joint Cybersecurity Advisory CSA to provide information on Maui ransomware, which has been used by North Korean state-sponsored...

artofhealthcare.nz Cross Site Scripting vulnerability OBB-2730089

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

CISA, the Federal Bureau of Investigation FBI, and the Department of the Treasury Treasury have released a joint Cybersecurity Advisory CSA, North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector, to provide information on Maui ransomware,...

Hospital Management System SQL Injection Vulnerability (CNVD-2022-74093)

Hospital Management System is a computer system that helps manage health care-related information and helps health care providers do their jobs efficiently. hospital Management System v1.0 is vulnerable to a SQL injection vulnerability that originates in the orders.php page's An SQL injection iss...

MedusaLocker Ransomware is back targeting organizations in US

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary Since 2019, a ransomware-as-a-service RaaS known as MedusaLocker has been seen to target organizations, mostly in the healthcare sector by exploiting Remote Desktop Protocol RDP vulnerabilities...

Ex-Canadian Government Employee Pleads Guilty Over NetWalker Ransomware Attacks

A former Canadian government employee this week agreed to plead guilty in the U.S. to charges related to his involvement with the NetWalker ransomware syndicate. Sebastien Vachon-Desjardins, who was extradited to the U.S. on March 10, 2022, is accused of conspiracy to commit computer fraud and wi...

Patchable and Preventable Security Issues Lead Causes of Q1 Attacks

Eighty-two percent of attacks on organizations in Q1 2022 were caused by the external exposure of a known vulnerabilities in the victim’s external-facing perimeter or attack surface. Those unpatched bugs overshadowed breach-related financial losses tied to human error, which accounted for 18...

For Ransomware Double-Extorters, It's All About the Benjamins — and Data From Healthcare and Pharma

Welcome to the second installment in our series looking at the latest ransomware research from Rapid7. Two weeks ago, we launched "Pain Points: Ransomware Data Disclosure Trends", our first-of-its-kind look into the practice of double extortion, what kinds of data get disclosed, and how the...

OFFIS DCMTK

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable from an adjacent network/low attack complexity Vendor: OFFIS Equipment: DCMTK Vulnerabilities: Path Traversal, Relative Path Traversal, NULL Pointer Dereference 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow...

Watch out for the email that says “You have a new voicemail!”

A phishing campaign is using voicemail notification messages to go after victims Office 365 credentials. According to researchers at ZScaler, the campaign uses spoofed emails with an HTML attachment that contains encoded javascript. The email claims that you have a new voicemail and that you can...

Ransomware Risk in Healthcare Endangers Patients

In the last two years, COVID-19 has occupied healthcare providers’ minds — rightfully so, considering the pandemic’s tremendous toll on patients. But another threat that causes immense harm gets less attention: ransomware. While ransomware attacks receive lots of headlines, the irreparable damage...

Email compromise leads to healthcare data breach at Kaiser Permanente

At least 69,000 people have been impacted by a data breach at Kaiser Permanente, a long-running managed healthcare consortium. The latest in a long-running series of healthcare attacks, the road to stolen data began on April 5 this year with an email compromise. The direct path to data A...

LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-62205)

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. version 2.0.0 of LibreHealth EHR is vulnerable to a cross-site scripting vulnerability that originates in the...

LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-62206)

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. The navigation.php page lacks filtering and escaping for parameters. An attacker could exploit this vulnerability to...

LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-65030)

LibreHealth EHR is a clinically-focused electronic health record HER system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings. libreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...

LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-65033)

LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. a cross-site scripting vulnerability exists in LibreHealth EHR Base version 2.0.0. The vulnerability stems from a...