HC3 TLP White: APT41 Citrix and Zoho Attacks on Healthcare, March 26, 2020

A recent campaign of cyberattacks from a foreign threat actor targeted healthcare organizations and specifically exploited Citrix and Zoho technologies used for remote desktop services among others. These attacks allow attackers the ability to conduct reconnaissance and execute code on the victim systems and access to corporate networks. Patches have been released for both vulnerabilities and should be implemented as soon as possible.

Related Resources

Standards/Guidelines
Public
Agent Tesla is an established Remote Access Trojan (RAT) written in .Net. A successful deployment of Agent Tesla provides attackers with full computer or…
Webinar Recordings
Public
The U.S. Department of Health and Human Services’ (HHS) Health Sector Cybersecurity Coordination Center (HC3) invites you to join its monthly cybersecurity…
Guides/Reports
Working from Home during COVID-19 Pandemic During the COVID-19 pandemic, many physicians are working from home, using their personal computers and mobile…
Guides/Reports
Public
Mozilla Patches Critical Vulnerabilities in Firefox, Firefox ESR 04/03/2020 04:45 PM EDT Original release date: April 3, 2020 Mozilla has released security…
Advisory
Public
The Centers for Medicare & Medicaid Services will prioritize and conduct only certain surveys during the COVID-19 national emergency’s three-week…
Action Alert
Public
Leaders from the Senate, House and Administration continue to negotiate a third spending package related to the novel coronavirus (COVID-19). Senate Majority…