HighSecurity.ai Command Center — DORMANT by default, COMBAT only when verified
Threat signal detected. Classical sensors verifying. AI models on standby.
Ransomware
None, no software flaw used
A Citrix remote access portal protected only by a stolen password, with no multi factor authentication.
No software patch. Fixed by turning on multi factor authentication on every remote access portal.
No software flaw, fixed with security settings
The largest US healthcare data breach, affecting around 190 million people.
Require multi factor authentication everywhere, watch for stolen passwords and keep tested backups.
Remote access vulnerability exploit
CVE-2024-1709, CVE-2024-1708
An authentication bypass and a path traversal flaw in self hosted ScreenConnect servers.
ConnectWise ScreenConnect 23.9.8 or later.
Patched securely by the vendor update
Ransomware deployed through IT providers and businesses within days of disclosure.
Update ScreenConnect at once, check for new admin users and limit who can reach the server.
VPN vulnerability exploit
CVE-2023-46805, CVE-2024-21887
An authentication bypass and a command injection flaw in Ivanti Connect Secure and Policy Secure VPN gateways.
Ivanti fixed versions released from 31 January 2024.
Patch available, extra steps needed to be secure
Thousands of VPN gateways broken into, including government networks.
Install the fixed version, run Ivanti's integrity checker, factory reset devices that show tampering and reset passwords and certificates.
Session hijacking leading to ransomware
CVE-2023-4966
A memory leak in Citrix NetScaler ADC and Gateway that exposed live session tokens, letting attackers skip passwords and MFA.
NetScaler ADC and Gateway 14.1-8.50, 13.1-49.15, 13.0-92.19 or later.
Patch available, extra steps needed to be secure
Used against Boeing, ICBC and many others.
Update NetScaler, then end every active and saved session, because stolen sessions keep working after the update.
File transfer data theft and extortion
CVE-2023-34362
A SQL injection flaw in the Progress MOVEit Transfer web app.
Progress MOVEit Transfer security updates of 31 May 2023 and the follow up fixes released in June 2023.
Patched securely by the vendor update
Over 2,700 organisations and around 90 million people affected, including the BBC, British Airways and Boots.
Apply every MOVEit update, check for the web shell the attackers left and reset service account passwords.
File transfer data theft and extortion
CVE-2023-0669
A flaw in the Fortra GoAnywhere file transfer admin console reachable from the internet.
Fortra GoAnywhere MFT 7.1.2 or later.
Patched securely by the vendor update
Around 130 organisations had data stolen.
Update GoAnywhere and keep the admin console off the public internet.
Software library vulnerability exploit
CVE-2021-44228, CVE-2021-45046
The Apache Log4j logging library could load remote code from a crafted text message that was written to a log.
Apache Log4j 2.17.1 or later (versions 2.15 and 2.16 were incomplete fixes).
Patched securely by the vendor update
Hundreds of millions of devices and apps affected across almost every industry.
Find every copy of Log4j, including inside other products, update to 2.17.1 or later and block unneeded outbound connections from servers.
Supply chain ransomware
CVE-2021-30116
Flaws in the Kaseya VSA remote management server used by IT providers, abused to push ransomware to their customers.
Kaseya VSA 9.5.7a (July 2021).
Patched securely by the vendor update
Between 800 and 1,500 businesses hit through about 60 IT providers.
Keep remote management tools updated, never expose them openly to the internet and give them only the access they need.
Ransomware
None, no software flaw used
An old VPN account protected only by a leaked password, with no multi factor authentication.
No software patch. Fixed by turning on multi factor authentication and removing unused accounts.
No software flaw, fixed with security settings
The largest fuel pipeline in the US shut down for several days. A 4.4 million US dollar ransom was paid.
Require multi factor authentication on every remote access account and disable accounts that are no longer used.
Server vulnerability exploit
CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065
Flaws in on premises Microsoft Exchange Server that let attackers get in without a password and plant web shells.
Microsoft Exchange security updates of March 2021.
Patch available, extra steps needed to be secure
Tens of thousands of Exchange servers broken into worldwide.
Install the updates, scan for and remove web shells, and do not expose Exchange admin pages to the internet.
Supply chain
None, no software flaw used
Hidden code added to signed SolarWinds Orion software updates during the build process.
SolarWinds Orion Platform 2020.2.1 HF2 or later.
Patch available, extra steps needed to be secure
About 18,000 organisations received the tampered update, including US government agencies.
Update Orion, rebuild affected servers, reset all passwords and keys the software could reach and watch for unusual sign ins.
Destructive wiper posing as ransomware
CVE-2017-0144, CVE-2017-0145
A tampered update of the M.E.Doc accounting software, then the EternalBlue and EternalRomance SMB flaws and stolen passwords to spread.
Microsoft security update MS17-010 and a clean, verified M.E.Doc update.
Patch available, extra steps needed to be secure
Around 10 billion US dollars of damage worldwide, including Maersk and Merck.
Patch SMB, limit admin rights, split the network into zones and check software updates come from a trusted source. Paying does not recover files.
Ransomware worm
CVE-2017-0144
EternalBlue flaw in the Windows SMBv1 file sharing service, letting the worm spread between unpatched computers.
Microsoft security update MS17-010 (March 2017), plus emergency fixes for Windows XP and Server 2003.
Patched securely by the vendor update
Over 200,000 computers in 150 countries, including large parts of the NHS.
Install MS17-010, turn off SMBv1, block port 445 from the internet and keep offline backups.