company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO

Application Security Engineer

DevsecOps Engineer

IT Manager

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Clop

Hertz

loading..
loading..
loading..

Clop Ransomware Behind Hertz Data Breach Exploits Cleo Zero-Day Vulnerabilities

Hertz data breach: Cleo zero-day attack exposes customer info. Learn how Clop ransomware impacted over 1,000 companies in 2024-2025

16-Apr-2025
8 min read

No content available.

Related Articles

loading..

ClickFix

Recent cybersecurity investigations reveal that advanced persistent threat (APT)...

Recent cybersecurity investigations reveal that advanced persistent threat (APT) groups from North Korea, Iran, and Russia have adopted the ClickFix social engineering tactic to deploy malware across critical sectors. This technique, initially popularized by cybercriminals, has become a favored tool for nation-state actors due to its effectiveness in bypassing user vigilance. ## Evolution of ClickFix in Cyber Espionage ClickFix operates by convincing targets to execute malicious commands under the guise of resolving technical issues or completing verifications. Unlike traditional phishing, this method leverages user compliance, making it exceptionally effective for initial access[1][6]. ### Mechanics of ClickFix Attacks The attack chain typically begins with a phishing email containing a link to a spoofed website. Users are instructed to copy and run PowerShell or Command Prompt scripts, initiating multi-stage payload deliveries. For example, TA427 (Kimsuky) used fake Japanese Embassy pages to distribute QuasarRAT, while TA450 (MuddyWater) disguised attacks as Microsoft security updates to deploy remote management tools[1][4]. #### Payload Delivery and Persistence Malicious scripts often create scheduled tasks or VBS files to maintain persistence. TA427’s campaign employed a VBS script that ran every 19 minutes, fetching batch files to decode and execute QuasarRAT[1][6]. Similarly, UNK_RemoteRogue used compromised Zimbra servers to redirect victims to pages with embedded Empire C2 framework code[4][6]. ## Sector-Specific Targeting and Global Impact ### North Korean Operations: TA427’s Think Tank Focus Between January and February 2025, TA427 targeted fewer than five organizations analyzing North Korean policy. By impersonating Japanese diplomats, they lured victims to fake embassy sites, where ClickFix commands triggered malware downloads. Dynamic DNS services like FreeDNS hosted these domains, with infrastructure traced to South Korean servers[1][6]. ### TA450 and UNK_RemoteRogue TA450’s November 2024 campaign exploited Microsoft’s Patch Tuesday, distributing emails urging users to run PowerShell commands for “critical updates.” This installed Level RMM software, enabling data exfiltration from Middle Eastern governments and Western enterprises[4][14]. Concurrently, UNK_RemoteRogue targeted defense contractors via compromised Zimbra emails, linking to fake Office documents that prompted PowerShell executions[6][14]. ### Russian Involvement: TA422’s Covert Activities Though less documented, TA422 (APT28) has integrated ClickFix into existing workflows, focusing on European energy and logistics sectors. Their tactics mirror historical patterns of leveraging legitimate tools like PowerShell for stealth[4][6]. ## Mitigation Strategies and Defense Recommendations ### Enhanced User Training and Technical Safeguards Organizations must prioritize security awareness programs highlighting ClickFix’s social engineering hooks. Technical measures like restricting PowerShell execution and monitoring scheduled tasks can disrupt attack chains.

loading..   17-Apr-2025
loading..   3 min read
loading..

Healthcare

DaVita, a major kidney care provider, suffered a ransomware attack that encrypte...

DaVita, a prominent kidney care provider in the United States, disclosed on Monday that it has fallen victim to a ransomware attack. The cyberattack encrypted parts of its network, causing operational disruptions and raising alarms about potential data theft. DaVita, which operates over 2,600 dialysis centers and employs over 76,000 individuals worldwide, is now working to contain the attack and mitigate its impact on patient care.* ### What Happened During DaVita's Ransomware Attack? On April 12, 2025, DaVita confirmed in an SEC FORM-8K filing that it became aware of a ransomware incident that had encrypted certain parts of its network. The attack occurred on a weekend, a typical strategy for cybercriminals, as IT teams are often understaffed and slower to respond during this time. In response, DaVita promptly activated its security protocols and implemented containment measures to isolate the affected systems. The company has yet to provide a clear timeline for when the impacted operations will return to normal, though it remains focused on restoring its network. ### Impact on Operations and Patient Care Despite the ransomware attack, DaVita stated that it continues to provide care to patients across its treatment centers. The company assured stakeholders that its contingency plans were effectively activated to ensure that critical healthcare services, such as dialysis, are not compromised. While the ransomware attack has disrupted some operational processes, the company has emphasized that patient safety and care remain a top priority. DaVita has also taken interim steps to restore impacted systems as quickly as possible. ### Patient Data Security Concerns One of the most pressing concerns in the aftermath of a ransomware attack is the potential theft of sensitive data. In the filing, DaVita mentioned that the scope of the breach, including whether patient data had been accessed or stolen, is still under investigation. This concern is particularly significant as ransomware gangs often steal data before encrypting it in a bid to extort additional payment from their victims. Given DaVita's size and prominence in the healthcare industry, any breach involving patient data could have serious repercussions for both the company and its patients. As of now, there has been no confirmation of data theft, but the company is conducting a thorough investigation to determine the full extent of the attack. ### Company’s Immediate Actions and Response Upon detection of the ransomware attack, DaVita acted quickly by isolating the affected systems to prevent further damage. The company’s security teams have been working tirelessly to restore operations while also ensuring that all critical patient care services remain uninterrupted. DaVita's swift response illustrates the effectiveness of its contingency plans, which are designed to minimize disruption in the face of cyberattacks. However, as the investigation progresses, the company has made it clear that more details about the attack’s full impact will be provided as soon as they are available. ### What’s Next for DaVita and Its Customers? The ransomware attack on DaVita raises serious questions about the security of sensitive patient data within the healthcare industry. As cyberattacks on healthcare providers continue to rise, it is becoming increasingly critical for companies in the sector to bolster their cybersecurity measures to protect patient information and maintain trust. While DaVita has yet to determine the full extent of the damage, including any potential patient data theft, it remains committed to restoring its network and operations. The company has assured the public that it will keep stakeholders informed as more information becomes available. ### How Can Healthcare Providers Protect Themselves From Ransomware Attacks? Healthcare organizations like DaVita are prime targets for ransomware attacks due to the critical nature of the services they provide and the sensitive data they store. In response to growing cybersecurity threats, healthcare providers must implement robust security protocols, including the following: 1. **Regularly Update Systems and Software:** Keeping software up to date ensures that known vulnerabilities are patched, reducing the likelihood of an attack. 2. **Employee Training on Cybersecurity Best Practices:** Educating employees about phishing emails and other common attack vectors can help prevent ransomware from gaining access to networks. 3. **Data Backup and Encryption:** Ensuring that critical data is backed up and encrypted can make it easier to recover if a ransomware attack occurs. 4. **Incident Response Planning:** Having a well-defined incident response plan in place allows organizations to respond swiftly and minimize damage during a cyberattack. The recent ransomware attack on DaVita highlights the ongoing cybersecurity challenges faced by healthcare organizations, particularly those that manage sensitive patient data. While the company continues to investigate the attack and restore operations, patient care remains a priority, and DaVita has implemented contingency measures to minimize disruptions. As the investigation unfolds, stakeholders will be keenly watching for any updates regarding the potential theft of patient data and how DaVita plans to prevent future cyberattacks. Healthcare providers must take immediate action to safeguard their networks and data to prevent similar incidents from occurring in the future. In an increasingly connected world, ransomware attacks are an unfortunate reality that organizations must prepare for. With a focus on proactive cybersecurity measures and quick response protocols, healthcare companies like DaVita can minimize the impact of such incidents and continue providing vital services to their patients. --- **Keywords:** DaVita ransomware attack, ransomware attack healthcare, cybersecurity, patient data security, ransomware response, DaVita ransomware breach, healthcare cybersecurity, data encryption, ransomware incident response, cybersecurity measures in healthcare. **Meta Description:**

loading..   15-Apr-2025
loading..   5 min read
loading..

VPN

SSL

Fortinet alert: Patch FortiGate SSL-VPN exploits. Hackers used symlinks to retai...

A newly disclosed Fortinet advisory reveals that hackers have maintained stealthy, persistent access to compromised FortiGate devices even after organizations patched the initial vulnerabilities used in the attacks.** The campaign, active since early 2023, underscores growing concerns over advanced post-exploitation techniques targeting network infrastructure. ### **How the Attack Works** Threat actors exploited known flaws, including critical CVEs like CVE-2022-42475 (a remote code execution bug) and CVE-2023-27997 (a heap overflow vulnerability), to create a **symbolic link (symlink)** between FortiGate’s user file system and root file system. This symlink, hidden in folders hosting SSL-VPN language files, granted attackers read-only access to sensitive configurations and system data. Fortinet confirmed that the symlink persisted even after initial vulnerabilities were patched, enabling continued surveillance. Devices with SSL-VPN functionality enabled are exclusively at risk. ### **Fortinet’s Mitigation Measures** The company rolled out urgent FortiOS updates to eliminate the threat: - **Versions 7.6.2, 7.4.7, 7.2.11, 7.0.17, 6.4.16**: Remove malicious symlinks and block future SSL-VPN-based exploits. - **Antivirus enhancements**: Older FortiOS versions (7.4, 7.2, 7.0, 6.4) now detect and auto-delete the symlink. Fortinet advises all users to: 1. Immediately upgrade to the latest firmware. 2. Audit device configurations for tampering. 3. Assume credentials are compromised and reset them. ### **Global Cybersecurity Alerts** The **U.S. CISA** and France’s **CERT-FR** issued parallel advisories, urging organizations to: - Disable SSL-VPN until patches are applied. - Monitor for unauthorized access dating back to early 2023. ### **Expert Insights: “Attackers Are Outpacing Defenders”** Benjamin Harris, CEO of cybersecurity firm watchTowr, warned *The Hacker News* that adversaries are exploiting vulnerabilities faster than companies can patch. “Attackers deploy backdoors designed to survive patches, upgrades, and even factory resets,” Harris said, noting impacts on **critical infrastructure sectors**. ### **What’s Next?** Fortinet has notified affected customers directly, though the campaign’s global, non-targeted nature complicates attribution. Organizations must prioritize: - **Patch compliance**: Apply updates to break attacker persistence. - **SSL-VPN scrutiny**: Disable if unused or until secured. - **Configuration audits**: Treat all settings as potentially compromised.

loading..   12-Apr-2025
loading..   2 min read