Week of March 4, 2024: Change Healthcare Fallout, Microsoft's Widening Breach

Security leaders tracked updated SEC disclosures from UnitedHealth Group on the Change Healthcare intrusion and from Microsoft on an expanding nation-state compromise of its source code repositories, alongside CISA's addition of actively exploited JetBrains TeamCity and Apple iOS flaws to its Known Exploited Vulnerabilities Catalog. Apple also shipped security updates addressing vulnerabilities that could let an attacker take control of affected systems, while CISA and NSA published joint guidance on cloud security best practices.

UnitedHealth Group Updates SEC Filing on Change Healthcare Intrusion

UnitedHealth Group amended its Form 8-K to update regulators on the cyberattack affecting Change Healthcare information technology systems. The filing stated that cybercrime threat actors had gained access to the systems and that the company isolated affected systems upon detection. UnitedHealth said it notified customers, law enforcement, and government agencies, and that it was working to restore pharmacy, medical claims, and payment services. The company said it had not determined whether the incident was reasonably likely to materially affect its financial condition or results of operations, and referenced a press release issued March 7, 2024, describing its restoration timeline. (U.S. Securities and Exchange Commission (EDGAR))

Microsoft Discloses Widening Nation-State Breach of Source Code

Microsoft amended its Form 8-K to report that a nation-state threat actor, which had accessed employee email accounts beginning in late November 2023, had expanded its intrusion. The company said the threat actor used information it previously obtained to gain or attempt to gain unauthorized access to some of Microsoft's source code repositories and internal systems. Microsoft described the activity as an ongoing, sustained attack and said it increased security investments and cross-enterprise coordination in response. The company said it continued to coordinate with federal law enforcement and had not determined the incident was reasonably likely to materially affect its financial results. (U.S. Securities and Exchange Commission (EDGAR))

CISA Adds Actively Exploited JetBrains TeamCity Flaw to KEV Catalog

CISA added CVE-2024-27198, a JetBrains TeamCity authentication bypass vulnerability, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The agency pointed organizations to a JetBrains blog addressing both CVE-2024-27198 and a related vulnerability, CVE-2024-27199, and urged an update to TeamCity On-Premises version 2023.11.4. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate catalog vulnerabilities by a set due date, and CISA encouraged all organizations to prioritize patching as part of routine vulnerability management practice. (CISA)

CISA Adds Two Exploited Apple iOS Memory Corruption Flaws to KEV

CISA added two Apple iOS and iPadOS memory corruption vulnerabilities, CVE-2024-23225 and CVE-2024-23296, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The additions followed Apple's own security updates for iOS and iPadOS released the same week. CISA said these vulnerability types remain frequent attack vectors for malicious cyber actors and pose significant risk to the federal enterprise. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate the two vulnerabilities by their assigned due dates, and CISA again urged all organizations to prioritize timely patching. (CISA)

Apple Patches Multiple Products Including Safari, macOS, watchOS, tvOS

Apple released security updates for Safari, macOS Sonoma, macOS Ventura, macOS Monterey, watchOS, tvOS, and visionOS, addressing vulnerabilities that a threat actor could exploit to take control of an affected system. CISA urged users and administrators to review Apple's advisories and apply updates including Safari 17.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, macOS Monterey 12.7.4, watchOS 10.4, tvOS 17.4, and visionOS 1.1. The release came in the same week CISA separately flagged two actively exploited Apple iOS and iPadOS memory corruption vulnerabilities for its Known Exploited Vulnerabilities Catalog. (CISA)

CISA and NSA Issue Joint Cloud Security Best Practice Guidance

CISA and the National Security Agency released five joint Cybersecurity Information Sheets covering secure cloud identity and access management, cloud key management, network segmentation and encryption in cloud environments, securing data in the cloud, and mitigating risks from managed service providers. The agencies encouraged organizations to review the practices and implement the recommended mitigations to strengthen their cloud security posture, pointing to CISA's Secure Cloud Business Applications project and Trusted Internet Connections pages for additional resources on cloud security best practices. (CISA)