Week of June 3, 2024: Synnovis ransomware hits London hospitals, and CISA flags Snowflake account attacks

What mattered to security leaders in the week of June 3, 2024? A ransomware attack on Synnovis, a pathology supplier to the NHS, forced several major London hospitals to cancel operations and declare a critical incident, while CISA amplified Snowflake's call for customers to hunt for unauthorized access to their data platform accounts. Microsoft also reversed course on Windows Recall, making the screenshot feature opt-in after sustained criticism from security researchers.

Synnovis ransomware attack leaves London hospitals without pathology services

An attack on Synnovis, which runs pathology services such as transfusion blood testing for NHS organizations, was detected on Monday, June 3. By June 4, operations had been canceled at several large London hospitals and a critical incident declared, with Guy's and St Thomas' and King's College Hospital among the trusts affected and blood transfusions hit hardest. The Department of Health and Social Care, NHS England and the National Cyber Security Centre said they were jointly investigating. For hospital security teams, it showed how a single diagnostics vendor can halt clinical care. (The Record)

CISA urges Snowflake customers to hunt for unauthorized access

On June 3 CISA published an alert noting that Snowflake had reported, on June 2, a rise in threat activity aimed at customer accounts on its cloud data platform. Snowflake advised users to query for unusual activity and investigate further, and CISA asked organizations to hunt for malicious activity and report positive findings to the agency. The alert put credential hygiene on third-party data platforms, not just internal systems, on the agenda for many security teams. (CISA)

Microsoft makes Windows Recall opt-in and encrypts its index

On Friday, June 7, Microsoft announced changes to Windows Recall, the Copilot+ PC feature that captures screenshots every few seconds, ahead of its planned June 18 preview release. Researchers had shown that its database was unencrypted and easy for malware to exfiltrate, and that the feature was on by default. Recall will now stay off unless users enable it, the search index will be encrypted, and access will require Windows Hello Enhanced Sign-in Security. Endpoint teams gained a clearer basis for deciding whether to allow it on managed devices. (Help Net Security)

Sophos details Crimson Palace, a two-year Chinese espionage campaign

Sophos published its Operation Crimson Palace report on a nearly two-year espionage operation against a high-level government target in Southeast Asia. Its managed detection team found three distinct clusters of activity against the same organization, two of them overlapping with the tactics of BackdoorDiplomacy, APT15 and the APT41 subgroup Earth Longzhi, and a previously unseen persistence tool it named PocoProxy. Sophos cautioned that fixating on a single Chinese attribution can hide how closely these groups coordinate. (Help Net Security)

Webex cloud flaw exposed meeting details of European authorities and firms

A weakness first found in self-hosted Webex instances used by the German armed forces and the SPD also affected Cisco's Webex cloud service, according to reporting published June 5. Because meeting numbers were not assigned randomly, metadata about past and future meetings of Germany's BSI, the Bundestag, federal ministries and companies in several European countries could be retrieved with a browser. It is unknown whether anyone exploited it before disclosure. Collaboration platforms carry sensitive metadata even when meeting content is protected. (Help Net Security)

361 million addresses from Telegram combolists added to Have I Been Pwned

Troy Hunt loaded a trove of 361 million email addresses into Have I Been Pwned, 151 million of them new to the service. The data, handed over by an unnamed researcher, came from more than 1,700 files scraped from thousands of Telegram channels and paired addresses with passwords and often the affected website. Hunt's checks pointed to earlier breaches and infostealer malware as the origin. Organizations can check their domains against the set to find exposed staff credentials. (Help Net Security)

An old Oracle WebLogic flaw joins CISA's exploited list

On June 3 CISA added CVE-2017-3506, an OS command injection vulnerability in Oracle WebLogic Server, to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Federal civilian agencies must remediate catalog entries by a set due date under BOD 22-01. The addition of a seven-year-old bug is a reminder that legacy middleware stays a live target. (CISA)