KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2024-1709
ConnectWise · ScreenConnect
Authentication bypass using an alternate path vulnerability allowing attackers to create administrative accounts in remote support software.
Correlated Federal Court Cases & Exploitation Context (1)
Docket SEC CIK 0000731766 · U.S. District Court for the District of Minnesota
ALPHV / BlackCat Ransomware Attack on Change Healthcare Devastating ransomware attack and data extortion of Change Healthcare (UnitedHealth Group) that paralyzed medical billing, prescription processing, and healthcare provider reimbursement nationwide.
Exploitation Ground Zero: Stolen credentials used to enter an unsegmented Citrix remote access portal lacking multifactor authentication, combined with exploitation of ScreenConnect (CVE-2024-1709) for persistence.
Operational Impact: Disrupted 1 in every 3 medical prescriptions in the United States. Pharmacies were unable to process electronic insurance claims, military medical clinics were forced into manual paper forms, and hospital systems suffered severe cash flow crunches totaling over $2 billion. Change Healthcare paid a 350 BTC ($22M) ransom.
Sector: Healthcare and Public Health · Loss: $2.5 billion
Inspect Full Case Dossier →
Associated Government Advisories
- AA24-060A CISA Alert →