This week, we explore the lessons learned from the Change Healthcare breach, recent Dropbox breach, and HPE ArubaOS critical vulnerabilities.
UnitedHealth made an attempt to contain the fallout by paying BlackCat a reported $22 million ransom.
Unfortunately, the threat actors behind the BlackCat group used this as an opportunity to pull an exit scam, taking the ransom payment and leaving their affiliate empty-handed and UnitedHealth patient data still at risk of being leaked.
Not only did UnitedHealth lose millions from the large ransom payment, but it is estimated that total financial damages from the incident have reached over $872 million for the quarter, including $593 million in "direct cyberattack response costs", and a total cost of $1.6 billion in 2024. Last week, details were revealed on what allowed the attack to take place.
According to testimony from UnitedHealth CEO Andrew Witty, threat actors were able to gain initial access to Change Healthcare's network by leveraging compromised credentials to authenticate to the Change Healthcare Citrix portal. It is unknown if these credentials were obtained via phishing or infostealer malware.
It should be noted that the Citrix portal did not have multi-factor authentication (MFA) enabled.
Once this initial foothold was established, the threat actor spent 10 days moving laterally throughout the network, stealing data, and deploying the ransomware encryptor.
Remote access tools such as Citrix and other VPN gateways are heavily targeted by threat actors. These network "front doors" are generally compromised in one of two ways: through stolen legitimate credentials or remote exploit of a vulnerability.
From the testimony, it was disclosed that the threat actor had full access to the internal network for 10 days before the ransomware was finally detonated.
There are numerous detection and prevention opportunities to thwart threat actor activities before their final objectives are completed:
The UnitedHealthcare breach is a shining example of how unsophisticated many of the hacking techniques used by major threat actors are. Most are not using 0-days or sophisticated malware; they are simply abusing poor security practices. Organizations can take simple yet impactful steps to improve their security posture and not be easy targets.
Additional Resources
Per the filing, on April 24, Dropbox became aware that an unknown threat actor had gained access to data of all users of Dropbox Sign including usernames and email addresses.
For an undisclosed "subset" of users, threat actors also were able to access phone numbers, hashed passwords, and other authentication information such as API keys, OAuth tokens, and multi-factor authentication.
At the time of the filing, Dropbox has found no evidence that the threat actor accessed actual contents of user accounts or the production environments of other Dropbox products.
Dropbox took the proactive step of resetting all user's passwords, logged out any devices that were connected to the service, and is rotating API keys and OAuth tokens.
Additional Resources
Of these 10 vulnerabilities, 4 are critical severity unathenticated remote code execution (RCEs).
These vulnerabilities are tracked as CVE-2024-26305, CVE-2024-26304, CVE-2024-33511, and CVE-2024-33512, and all are related to flaws in the PAPI (Aruba's access point management) protocol.
The following products are affected:
HPE Aruba Networking
Affected Software Versions:
While there are currently no known cases of active exploitation, administrators are urged to enable Enhanced PAPI Security and upgrade devices to the appropriate patched version as soon as possible.
Additional Resources
Stay updated with PacketWatch's cybersecurity content by subscribing to our monthly newsletter, delivered to your inbox on the last Tuesday of the month.
PacketWatch publishes this report and other cybersecurity threat intel to the security community for free via our blog.
If you want personalized threat intel, contact us today to learn about our enterprise threat intelligence services.
Note: We've also enriched our original threat intelligence report by including resources from our partner in cyber threat intelligence, SOCRadar. You may need a registered SOCRadar account to view their threat intelligence resources.
DISCLAIMER
Kindly be advised that the information contained in this article is presented with no final evaluation and should be considered raw data. The sole purpose of this information is to provide situational awareness based on the currently available knowledge. We recommend exercising caution and conducting further research as necessary before making any decisions based on this information.