Warning: North Korean Lazarus Group Exploiting ManageEngine Vulnerability, Targeting Healthcare Sector

Federal authorities have issued a warning about the “significant risk” of potential attacks on healthcare and public health sector entities by the North Korean state-sponsored Lazarus Group. These cybercriminals have been targeting the healthcare industry by exploiting a critical vulnerability in 24 ManageEngine IT management tools from Zoho.

Alert details

The U.S. Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HHS HC3) has recently released an alert regarding the activities of the Lazarus Group. This cybercriminal group has been focusing its attacks on internet backbone infrastructure and healthcare entities in Europe and the United States.

The vulnerability that is being exploited by the Lazarus Group is referred to as CVE-2022-47966. This critical vulnerability enables the attackers to gain unauthorized access and control over the ManageEngine software.

Vulnerability exploitation

The vulnerability tracked as CVE-2022-47966 can be exploited if the SAML (Security Assertion Markup Language) single sign-on is or has ever been enabled in the ManageEngine setup. This weakness allows attackers to deploy the remote access Trojan QuiteRAT, which gives them remote control over the compromised systems.

Connection to the Lazarus Group

According to HHS HC3, the attackers are using a remote access Trojan called QuiteRAT, which is believed to be connected to the Jupiter/EarlyRAT malware family. This malware family has been previously associated with the Lazarus Group’s subgroup known as Andariel. These connections strengthen the evidence linking these attacks to the Lazarus Group.

Recognition by authorities

The Cybersecurity and Infrastructure Security Agency (CISA) has added the CVE-2022-47966 flaw to its catalog of known exploited vulnerabilities, highlighting the seriousness of the vulnerability. In September, CISA and the Federal Bureau of Investigation (FBI) jointly released a bulletin warning of nation-state-sponsored actors exploiting this specific vulnerability in ManageEngine.

Previous reports on the vulnerability

Security researchers at Cisco Talos have been tracking the evolving threats posed by the Lazarus Group. In an August blog post, they highlighted the impact of the ManageEngine CVE-2022-47966 vulnerability. This vulnerability has gained attention due to its exploitation by the Lazarus Group in their targeted attacks.

Additionally, Caitlin Condon, the head of vulnerability research at security firm Rapid7, points out that various ManageEngine vulnerabilities have been exploited by different threat actors in the past several years. This indicates the ongoing challenges faced by healthcare and public health sector entities regarding their cybersecurity posture.

Overall threat landscape

The healthcare and public health sector entities are facing numerous serious threat actors, as emphasized by Caitlin Condon. These entities have become prime targets for cybercriminals due to the sensitive and valuable data they possess. Moreover, the reliance on interconnected systems and the rise of remote work in the healthcare sector have further increased their vulnerability to cyberattacks.

The warning from federal authorities regarding the Lazarus Group’s exploitation of the ManageEngine vulnerability is a crucial reminder of the need for robust cybersecurity measures in the healthcare and public health sector. Ongoing vigilance, prompt patch management, and the adoption of best practices are essential to protect against evolving cyber threats. It is vital for healthcare organizations and entities to collaborate with cybersecurity experts and government agencies to stay updated and better defend against sophisticated threat actors like the Lazarus Group.

Explore more

How Is AI Revolutionizing Email Marketing Strategies?

Setting the Stage for Digital Communication Evolution In today’s hyper-connected digital landscape, businesses send billions of emails daily, yet only a fraction capture attention amid overflowing inboxes, pushing marketers to seek innovative solutions. Artificial Intelligence (AI) has emerged as a game-changer in transforming email marketing from a generic broadcast tool into a precision-driven strategy. With the ability to analyze vast

How Is Embedded Finance Transforming UK Brand Experiences?

Imagine a world where purchasing a new gadget at a retail store instantly offers tailored financing options right at checkout, or where booking a vacation seamlessly includes travel insurance within the same app. This is the reality shaped by embedded finance, a transformative technology integrating financial services into non-financial platforms. As digital ecosystems continue to dominate consumer interactions in 2025,

Paid Content Marketing Triumphs in the AI Era over Earned Media

In the rapidly changing arena of digital marketing, a profound transformation is reshaping how brands connect with audiences, marking a significant shift in strategy. Once a dominant force, earned media—those organic news features or viral social media moments—has been dethroned as the go-to strategy for growth among businesses, musicians, and creators. Now, paid content marketing has surged to the forefront,

Job Openings Drop in July, Yet Hiring Remains Strong

Overview of the U.S. Labor Market In the heat of summer, as businesses and workers navigate an ever-shifting economic landscape, a striking statistic emerges from the U.S. labor market: job openings have dipped to 7.2 million in July, down from 7.4 million just a month prior, raising eyebrows especially when juxtaposed with the robust hiring figures of 5.3 million for

Trend Analysis: Cooling US Labor Market Dynamics

Introduction In a startling reflection of economic headwinds, US private sector job growth plummeted to a mere 54,000 in August, nearly half of the previous month’s tally of 106,000, signaling a profound slowdown in labor market momentum. This sharp decline arrives at a critical juncture, with economic uncertainty casting a long shadow, policy debates intensifying, and political figures like President