Week of August 14, 2023: Clorox discloses an IT intrusion, Colorado warns 4 million over IBM MOVEit breach

What mattered to security leaders in the week of August 14, 2023? The Clorox Company told investors on August 14 that unauthorized activity on its IT systems had forced some systems offline and was disrupting operations, and Colorado's Medicaid agency began warning more than four million people that their data was exposed through its contractor IBM's MOVEit server. Researchers also found webshells on 1,828 Citrix NetScaler appliances, most of them already patched, while attackers began exploiting a Citrix ShareFile flaw.

Clorox reports unauthorized activity on its IT systems

In a Form 8-K filed on August 14 under Item 8.01, The Clorox Company said it had identified unauthorized activity on some IT systems and had taken certain systems offline while it worked to stop and remediate it, coordinating with law enforcement. Workarounds kept some operations running, but the company said the incident had disrupted and would continue to disrupt parts of its business. The investigation, supported by outside cybersecurity experts, was described as early-stage. (The Clorox Company, SEC Form 8-K)

Colorado's Medicaid agency warns 4 million people after IBM's MOVEit server was breached

The Colorado Department of Health Care Policy & Financing, which runs Health First Colorado and Child Health Plan Plus, began alerting more than four million individuals that their personal and health data was exposed. The agency's own systems were not breached; files it held on a MOVEit Transfer application used by contractor IBM were accessed on or about May 28, 2023, during Clop's exploitation of CVE-2023-34362. Exposed fields included Social Security numbers, Medicaid and Medicare IDs, and clinical data. Once again, a copy of agency data held by a contractor was the exposed point. (BleepingComputer)

Fox-IT finds 1,828 backdoored NetScaler appliances, most already patched

Scanning with the Dutch Institute of Vulnerability Disclosure, Fox-IT researchers located webshells on 1,828 Citrix NetScaler ADC and Gateway devices compromised through CVE-2023-3519, an unauthenticated remote code execution flaw Citrix fixed on July 18. Of those, 1,248 had already been patched, meaning administrators closed the hole after attackers had planted a backdoor. The finding argues for compromise assessments, not just patch confirmation, after any exploited edge-device bug. (Help Net Security)

Citrix ShareFile storage zones flaw comes under attack

Attackers began exploiting CVE-2023-24489, a critical cryptographic bug in the storage zones controller of customer-managed Citrix ShareFile installations that Citrix had fixed in June. It can let an unauthenticated attacker upload files and ultimately run code. GreyNoise saw a sudden jump on Tuesday, August 15, in IP addresses attempting exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities Catalog. (Help Net Security)

CISA's JCDC publishes a cyber defense plan for remote monitoring tools

On August 16 CISA released the Remote Monitoring and Management Cyber Defense Plan, the first proactive plan built by industry and government partners through the Joint Cyber Defense Collaborative. CISA said ransomware crews and nation-state actors increasingly target RMM products to reach many downstream customers at once while evading detection. The plan covers RMM vendors, managed service providers, MSSPs, small businesses and critical infrastructure operators, so it is relevant to anyone whose MSP holds remote access to their environment. (CISA)

Researcher reports LockBit struggling to publish stolen data

BleepingComputer's weekly ransomware roundup on August 18 highlighted research by Jon DiMaggio finding that LockBit, long the most prolific leak-site operator, had a backend storage and bandwidth problem that often kept it from publishing stolen data. According to the report, the gang leaned on threats and reputation instead, and some affiliates began moving to other operations after its public representative went quiet. For incident responders, it undercuts the assumption that a LockBit leak threat will always be carried out. (BleepingComputer)