Week of April 22, 2024: Change Healthcare theft may cover much of the US, and ArcaneDoor hits Cisco ASA

What mattered to security leaders in the week of April 22, 2024? UnitedHealth Group said on April 22 that files taken in the February ransomware attack on Change Healthcare could cover a substantial proportion of people in America, and Cisco patched firewall zero-days exploited in ArcaneDoor, an espionage campaign against its ASA and Firepower devices. CrushFTP customers also faced an exploited file-transfer flaw, and Microsoft exposed GRU malware abusing the Windows Print Spooler.

UnitedHealth: Change Healthcare files may cover a substantial share of Americans

UnitedHealth Group said on Monday, April 22 that initial sampling found files with protected health or personal information that could cover a substantial proportion of people in America, and that identifying and notifying those affected would likely take several months. It offered two years of free credit monitoring and identity theft protection, and confirmed to CNN and CNBC that it had paid a ransom. The company furnished the April 22 press release to the SEC on April 24 as an amendment to its Item 1.05 filing. (The Record, UnitedHealth Group, SEC Form 8-K/A)

Cisco patches ArcaneDoor zero-days in ASA and Firepower firewalls

On April 24 Cisco released updates for CVE-2024-20353, CVE-2024-20359 and CVE-2024-20358 in Adaptive Security Appliance and Firepower Threat Defense software, and CISA added the two exploited flaws to its catalog. Cisco said a previously unknown actor it tracks as UAT4356, also called ArcaneDoor, used custom backdoors named Line Runner and Line Dancer on a small set of customers' devices, mostly between December 2023 and early January 2024. The initial intrusion method was still unknown, and Cisco did not name a country. (CISA, The Record)

CrushFTP flaw exploited as CISA sets a one-week patch deadline

CrushFTP said on Monday, April 22 that CVE-2024-4040, a vulnerability in its file transfer tool first disclosed on April 19 and found by Airbus CERT, was already being exploited, and urged customers to update or restrict access to known-good IP addresses. A company official said compromises were likely among slow patchers. On April 24 CISA added the bug to its exploited list alongside the two Cisco flaws and gave federal agencies until May 1 to patch, a deadline The Record described as reserved for urgent cases. (The Record, The Record)

Microsoft exposes GRU unit's GooseEgg Print Spooler tool

Microsoft researchers described GooseEgg, a launcher used by the GRU-linked group it tracks as Forest Blizzard, also known as APT28, to exploit CVE-2022-38028 in the Windows Print Spooler and elevate privileges to steal credentials. Microsoft said the group had used it since at least June 2020 against state, nongovernmental, education and transportation organizations in Ukraine, Western Europe and North America. Organizations that still run the Print Spooler on systems that never print had a reason to disable it. (The Record)

DHS forms an AI Safety and Security Board for critical infrastructure

The Department of Homeland Security announced on Friday, April 26 a new Artificial Intelligence Safety and Security Board to advise it on how AI is deployed across the 16 critical infrastructure sectors. Secretary Alejandro Mayorkas said members would come from technology companies, critical infrastructure operators, academia, government, and civil rights and privacy groups, and the board would produce practical recommendations and best practices. For infrastructure security teams, it adds a federal body to watch for AI guidance. (The Record)

Octapharma reopens plasma centers as BlackSuit claims the attack

Swiss plasma company Octapharma, which runs more than 180 donation centers worldwide, began reopening some sites with modified hours on Monday, April 22, after closing all centers from April 17 following unauthorized network activity. On Wednesday, April 24, the BlackSuit ransomware gang claimed responsibility. The company said its investigation with outside experts was ongoing. The shutdown shows how a ransomware event can halt collection work that feeds a medicine supply chain. (The Record)