Week of January 27, 2025: Contec Monitor Backdoor, SonicWall Flaw Under Attack

Security leaders watched CISA warn of a hard-coded backdoor in widely used Contec patient monitors and add an actively exploited Apple flaw to its Known Exploited Vulnerabilities Catalog, while more than 5,000 SonicWall firewalls sat unpatched against a critical SSLVPN bug. The same week brought a multinational takedown of the Cracked and Nulled cybercrime forums, confirmed ransomware exploitation of SimpleHelp RMM software against healthcare targets, and an SEC filing detailing a six-week operational disruption at ENGlobal Corporation.

CISA Adds Actively Exploited Apple Flaw to KEV Catalog

On January 29, 2025, CISA added CVE-2025-24085, a use-after-free flaw affecting multiple Apple products, to its Known Exploited Vulnerabilities Catalog after Fortinet confirmed active exploitation. The listing triggers Binding Operational Directive 22-01, requiring federal civilian agencies to remediate the vulnerability by a set deadline. CISA urged all organizations, not just federal agencies, to prioritize patching the flaw given its demonstrated use by malicious actors. The addition underscored continued attacker interest in Apple's mobile operating systems during the week. (CISA)

CISA Details Hard-Coded Backdoor in Contec Patient Monitors

On January 30, 2025, CISA published a fact sheet describing an embedded backdoor in firmware of the Contec CMS8000 patient monitor, a device used across US and EU healthcare settings to track vital signs. Analysts found a hard-coded IP address enabling hidden functionality alongside a flaw that exposes patient data in every firmware version examined. CISA said the backdoor could enable remote code execution and device reconfiguration, creating patient-safety risk, and pointed organizations to FDA mitigation guidance. The monitor is manufactured by a company headquartered in Qinhuangdao, China, and may be resold under other brand names. (CISA)

ENGlobal Discloses Six-Week Operational Disruption from Cybersecurity Incident

On January 27, 2025, ENGlobal Corporation filed an amended Form 8-K with the SEC providing additional detail on a cybersecurity incident first reported in December 2024. The Houston-based engineering firm said a threat actor had accessed its IT systems and encrypted data files, limiting access to business applications supporting financial and operating reporting for approximately six weeks. ENGlobal said operations were fully restored, sensitive personal information was involved, and the company planned to notify affected parties and regulators as required, while assessing the incident as not currently material to its financial results. (SEC EDGAR)

Thousands of SonicWall Firewalls Remain Exposed to Exploitable Flaw

Help Net Security reported on January 27, 2025, that more than 5,000 SonicWall firewalls remained unpatched against CVE-2024-53704, an improper-authentication bug in SonicOS's SSLVPN mechanism that SonicWall itself warned was at imminent risk of exploitation. Bishop Fox researchers said they had already exploited the flaw to hijack active SSL VPN sessions and planned to publish exploit code in February. A fix had been available since early January. SonicWall urged partners to limit SSL VPN exposure to trusted sources or disable internet-facing access until devices were updated. (Help Net Security)

International Operation Shuts Down Cracked and Nulled Cybercrime Forums

On January 30, 2025, law enforcement from Germany, Australia, Spain, Greece, Romania, Italy, France and the United States announced the seizure of Cracked and Nulled, two of the largest underground forums used for trading hacking tools, malware, DDoS services and leaked data since 2015 and 2018 respectively. German authorities said each site had around five million registered user accounts. Twelve domains were seized along with linked services including a payment processor and a hosting provider, and two individuals, including a German national, were arrested as part of the action, named Operation Talent. (Help Net Security)

Ransomware Actors Confirmed Exploiting SimpleHelp RMM Flaws Against Healthcare Targets

Following reports that attackers had used vulnerabilities in the SimpleHelp remote monitoring tool to access devices beginning January 22, 2025, the American Hospital Association and the Health-ISAC confirmed on January 31, 2025 that the flaws were being exploited by ransomware operators. Healthcare imaging platform operator Intelerad had already disabled SimpleHelp across its InteleShare client base as a precaution and advised customers to check systems for indicators of compromise. The episode highlighted continued risk from remote-access software vendors used widely across the healthcare supply chain. (Help Net Security)

CISA Issues Fifteen Industrial Control Systems Advisories Across the Week

CISA released seven Industrial Control Systems advisories on January 28, 2025, covering products from B&R, Schneider Electric, Rockwell Automation and Becton, Dickinson and Company, followed by eight more on January 30, 2025 affecting Hitachi Energy, New Rock Technologies, Schneider Electric, Rockwell Automation, Contec Health and Mitsubishi Electric equipment. The advisories detailed vulnerabilities and mitigations across energy, manufacturing and healthcare-adjacent control systems, giving asset owners technical guidance to reduce exposure in operational technology environments during the week. (CISA)