Week of February 19, 2024: Police seize LockBit's infrastructure, and Change Healthcare is breached

What mattered to security leaders in the week of February 19, 2024? An international police operation took control of the LockBit ransomware group's infrastructure, and two days later UnitedHealth Group detected an intruder in Change Healthcare's systems, an incident it reported in an 8-K on February 22. Meanwhile attackers moved quickly on an authentication bypass in ConnectWise ScreenConnect.

Operation Cronos takes over LockBit

The UK National Crime Agency, working with the FBI, Europol and other agencies, took control of LockBit's administration environment and its dark web leak site, and obtained the platform's source code and a large amount of intelligence on the group and its affiliates. The operation, announced on February 20, led to two arrests in Poland and Ukraine, the freezing of more than 200 cryptocurrency accounts and the takedown of 34 servers in eight countries. Police also reported recovering decryption keys. (Help Net Security)

UnitedHealth reports an intrusion at Change Healthcare

In a Form 8-K under Item 1.05, UnitedHealth Group said that on February 21 it identified a suspected nation-state associated threat actor with access to some Change Healthcare IT systems. It isolated the affected systems, could not estimate how long or how widely services would be disrupted, and said it believed the interruption was confined to Change Healthcare while the rest of the company kept operating. It also warned that certain networks and transactional services might not be accessible during the disruption, an early signal for the many organizations that depend on the company. (SEC EDGAR)

ScreenConnect authentication bypass exploited within days

ConnectWise disclosed two ScreenConnect flaws on Monday, February 19, and urged self-hosted customers to update to version 23.9.8. By Tuesday it confirmed exploitation attempts, and Huntress published technical analysis and a proof-of-concept demonstration. The flaws were assigned CVE-2024-1709, an authentication bypass, and CVE-2024-1708, a path traversal bug, and ConnectWise let customers no longer under maintenance upgrade to a fixed release. CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities catalog on February 22. Remote access tools used by managed service providers deserve a place on the same patch clock as VPNs. (Help Net Security, CISA)

Microsoft extends expanded audit logging to all federal agencies

CISA, the Office of Management and Budget, the Office of the National Cyber Director and Microsoft announced on February 21 that expanded logging in Microsoft Purview Audit would be available to all federal civilian agencies regardless of license tier, after a six-month pilot. Microsoft would enable the logs automatically and raise default retention from 90 days to 180 days, and CISA issued an Expanded Cloud Log Implementation Playbook. Commercial customers could use it as a benchmark when negotiating logging with any cloud provider. (CISA)

CISA, EPA and FBI publish top actions for water utilities

On February 21 CISA, the Environmental Protection Agency and the FBI released a joint fact sheet, Top Cyber Actions for Securing Water Systems, listing practical steps for water and wastewater utilities to protect their systems from malicious cyber activity. For suppliers to utilities, it is a quick read on what customers will be asked to prove. (CISA, EPA and FBI)

FTC orders Avast to pay $16.5 million over browsing data

The Federal Trade Commission said Avast would pay $16.5 million and be barred from selling or licensing web browsing data for advertising, to settle allegations that the company and its subsidiaries sold such data after promising to protect users from online tracking. The FTC said the data was sold to more than 100 third parties through the subsidiary Jumpshot. Security vendors handle a lot of customer telemetry, and this case shows regulators treating its resale as a privacy promise. (Help Net Security)