HHS Alerts Health Sector to Critical Cyber Vulnerability

The Department of Health and Human Services Sept. 18 alerted the healthcare sector to a critical vulnerability in ManageEngine products that allows an attacker to perform remote code execution and which a North Korean state-sponsored actor is reportedly using to target health care entities in Europe and the United States. HHS’ Health Sector Cybersecurity Coordination Center (HC3) strongly encourages organizations to apply the recommended update as soon as possible to avoid potential compromise.

“ManageEngine is a third-party strategic network technology that helps organizations monitor, manage and secure their IT infrastructure, including active directory management,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “As such, a compromise of ManageEngine technology could represent a strategic cyber risk to organizations and provide broad access to the sophisticated and dangerous Lazarus hacking group. How dangerous are they? In 2018 the FBI indicted a member of the group for his involvement in the 2014 destructive cyberattack against Sony, an $81 million theft from the Society for Worldwide Interbank Financial Telecommunications, and the 2017 global WannaCry ransomware attacks that struck multiple U.S. hospitals. We must closely monitor and secure third-party network management tools present in our environments, which like the SolarWinds compromise, represent a high-value strategic target for the ‘bad guys.’ We also must continue to demand that our mission-critical third-party technology providers adhere to the principles of ‘secure by design, secure by default.’” 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.