Week of December 5, 2022: Rackspace ties its Exchange outage to ransomware, and Apple expands iCloud E2EE

What mattered to security leaders in the week of December 5, 2022? On Tuesday, December 6, Rackspace confirmed that ransomware caused the outage of its Hosted Exchange service that began on December 2, leaving customers without hosted email, and two days later it warned them about phishing. In healthcare, HHS flagged the Royal ransomware gang as a threat to the sector and CommonSpirit Health reported that 623,774 patients were affected by its October attack, while Apple announced optional end-to-end encryption for iCloud backups.

Rackspace confirms ransomware behind its Hosted Exchange outage

On December 6 Rackspace said the suspicious activity it detected on Friday, December 2, which led it to isolate its Hosted Exchange environment, was a ransomware incident. The investigation, led by an outside cyber defense firm, was at an early stage, with no information on what data, if any, was affected; Rackspace said the incident appeared isolated to Hosted Exchange. On Thursday, December 8, it warned customers about phishing attempts exploiting the incident and advised them to monitor credit reports and bank statements. The outage made a case for planning a fallback for hosted email. (BleepingComputer, BleepingComputer)

HHS warns hospitals about the Royal ransomware operation

HHS's Health Sector Cybersecurity Coordination Center (HC3) published an analyst note on Wednesday, December 7, saying the Royal ransomware group had carried out multiple attacks on US healthcare organizations and should be considered a threat to the sector. Royal is a private operation without affiliates, staffed by experienced actors from other groups; first seen in January 2022, it ramped up sharply from September and moved from borrowed encryptors such as BlackCat's to its own. After each healthcare compromise, the group claimed it had leaked all the stolen data. (BleepingComputer)

CommonSpirit Health puts its October breach at 623,774 patients

CommonSpirit Health, the second largest US health system with 140 hospitals and over 1,000 care sites in 21 states, reported on December 8 that personal data for 623,774 patients was accessed in its October ransomware attack. The figure appeared on the US Department of Health and Human Services breach portal, where breaches affecting more than 500 people must be reported. On December 1 the organization had said for the first time that attackers reached files containing personal information, including records tied to Franciscan Medical Group and Franciscan Health in Washington state. (BleepingComputer)

Apple offers end-to-end encryption for iCloud backups

Apple announced Advanced Data Protection for iCloud, an opt-in setting that raises the number of end-to-end encrypted data categories from 14 to 23, adding iCloud Backup, Notes and Photos; iCloud Mail, Contacts and Calendar stay outside it. US users would get the option by the end of 2022 and other countries in early 2023. Turning it on requires two-factor authentication, updated devices and at least one alternative recovery method. Teams that support Apple fleets gained a strong privacy control to account for in their account recovery procedures. (Help Net Security)

Chrome V8 zero-day CVE-2022-4262 exploited in the wild

As Help Net Security reported on December 6, Google patched CVE-2022-4262, a type confusion flaw in Chrome's V8 JavaScript engine that attackers were exploiting, reported by a member of its Threat Analysis Group, which focuses on state-sponsored and other advanced threats. The bug could allow heap corruption through a crafted HTML page. Fixed builds were 108.0.5359.94 for Mac and Linux and 108.0.5359.94/.95 for Windows, and Microsoft Edge 108.0.1462.41 carried the same fix. CISA added the flaw to its Known Exploited Vulnerabilities catalog. (Help Net Security)

Pwn2Own Toronto pays $989,750 for 63 zero-days in consumer devices

At Pwn2Own Toronto, held from December 6 to December 9, 26 teams and researchers earned $989,750 for 63 zero-day exploits against fully updated phones, home automation hubs, printers, wireless routers, NAS devices and smart speakers in default configurations. A fully patched Samsung Galaxy S22 was compromised four times, once in 55 seconds. Many of the device classes on the target list, from printers to routers and NAS boxes, also sit on corporate networks and in home offices. (BleepingComputer)