The Department of Health and Human Services Sept. 18 alerted the health care sector to a critical vulnerability in ManageEngine products that allows an attacker to perform remote code execution and which a North Korean state-sponsored actor is reportedly using to target health care entities in Europe and the United States. HHS’ Health Sector Cybersecurity Coordination Center (HC3) strongly encourages organizations to apply the recommended update as soon as possible to avoid potential compromise.

“ManageEngine is a third-party strategic network technology that helps organizations monitor, manage and secure their IT infrastructure, including active directory management,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “As such, a compromise of ManageEngine technology could represent a strategic cyber risk to organizations and provide broad access to the sophisticated and dangerous Lazarus hacking group. How dangerous are they? In 2018 the FBI indicted a member of the group for his involvement in the 2014 destructive cyberattack against Sony, an $81 million theft from the Society for Worldwide Interbank Financial Telecommunications, and the 2017 global WannaCry ransomware attacks that struck multiple U.S. hospitals. We must closely monitor and secure third-party network management tools present in our environments, which like the SolarWinds compromise, represent a high-value strategic target for the ‘bad guys.’ We also must continue to demand that our mission-critical third-party technology providers adhere to the principles of ‘secure by design, secure by default.’” 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.

Related News Articles

Headline
The FBI, along with the National Security Agency and other international cybersecurity agencies, this week released a joint agency advisory on cyber operations…
Headline
The FBI's Internet Crime Complaint Center released an alert May 7 warning of cyber actors exploiting vulnerabilities in end-of-life routers. Routers dated 2010…
Headline
The FBI’s Internet Criminal Complaint Center May 15 released an alert warning of a malicious text and voice messaging campaign involving impersonators…
Headline
In his latest AHA Cyber Intel blog, John Riggi, AHA national advisor for cybersecurity and risk, examines the state of cyber and physical threats in 2025 as…
Headline
Health care had more cyberthreats last year than any other critical infrastructure industry, according to the FBI's 2024 Internet Crime Report released April…
Headline
The National Security Agency April 23 released a report on operational technology systems that includes recommendations for security policies and technical…