cyber.hendryadrian.com
Security News · huntress.com

Huntress Reviews Major Cyber Threats and Findings from 2024

· Original article ↗

Summary

Huntress recaps its 2024 observations, including ScreenConnect exploitation, malware and ransomware activity, phishing, and attacks targeting human rights defenders, and points readers to its 2024 Cyber Threat Report.

Key points

  • Huntress says attackers exploited critical ConnectWise ScreenConnect vulnerabilities, including CVE-2024-1709 and CVE-2024-1708.
  • The roundup describes a ransomware affiliate exploiting ScreenConnect while attempting to compromise a healthcare endpoint.
  • Huntress analyzed a new LightSpy spyware variant targeting macOS and developed detection rules.
  • A mass phishing campaign bypassed MFA using adversary-in-the-middle techniques, according to the roundup.
  • SocGholish operators used BOINC software in malicious installations to collect data, transfer files, and execute tasks.
  • Huntress reports that OceanLotus targeted Vietnamese human rights defenders for more than four years using persistence methods.
  • The roundup also covers Akira indicators, brute-force attacks on FOUNDATION accounting software, SafePay ransomware, and active exploitation of Cleo file-transfer products.

Article Details

Event Type
Huntress's 2024 retrospective of observed cyber threats, incidents, and research, including vulnerability exploitation, ransomware, malware, phishing, and targeting of human rights activists.
Impact
The article reports authentication-bypass vulnerabilities in ConnectWise ScreenConnect exploited by attackers, including a ransomware affiliate's attempted compromise of a healthcare endpoint; a mass phishing campaign that bypassed MFA; and other observed malware and ransomware activity. It highlights targeting of Vietnamese human rights defenders and active exploitation of Cleo file-transfer software. No incident-wide impact figures are provided.

CVE

CVE-2024-1708A Catastrophe For Control: Understanding the ScreenConnect Authentication Bypass (CVE-2024-1709 & CVE-2024-1708)CVE-2024-1709Detection Guidance for ConnectWise CVE-2024-1709

Threat Actors

OceanLotusAPT described as targeting Vietnamese human rights defenders for over four years.SocGholishMalware associated with new behaviors involving legitimate BOINC software, which could be configured to operate as C2.

Malware

AkiraAkira Ransomware IndicatorsLightSpyLightSpy Malware Malichusabout this threat, and we offered a technical breakdown of a new family of malware we’ve named "Malichus."SafePaySafePay Ransomware SocGholishBOINC Software Exploited by SocGholish

Vendors

CleoClosing out the year, we identified a critical threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, commonly used to manage file transfers. Our team wrote extensively about this threat, and we offered aConnectWiseConnectWise ScreenConnect Vulnerabilities 

Products

BOINCBOINC Software Exploited by SocGholishFOUNDATIONFOUNDATION Software Breaches HarmonyClosing out the year, we identified a critical threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, commonly used to manage file transfers. Our team wrote extensively about this threat, and we offered aLexiComClosing out the year, we identified a critical threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, commonly used to manage file transfers. Our team wrote extensively about this threat, and we offered aScreenConnectConnectWise ScreenConnect Vulnerabilities VLTransferClosing out the year, we identified a critical threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, commonly used to manage file transfers. Our team wrote extensively about this threat, and we offered a

Industries

accountingSeptember also brought us brute-force attacks on accounting software used by contractors, exposing the need for better credential hygiene across industries.HealthcareWe also explored the tactics, techniques, and procedures of a ransomware affiliate operator who exploited a ScreenConnect vulnerability and attempted to compromise a healthcare endpoint.

Related Articles