Secure Your Routers! Healthcare ALPHV/Blackcat Ransomware Updates

The US Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and the Department of Health and Human Services (HHS) has released an update to their joint advisory about the ALPHV/Blackcat ransomware-as-a-service (RaaS). The new information includes new indicators of compromise, as well as associated tactics, techniques, and procedures. The ALPHV/Blackcat attacks have been focusing their attention on the healthcare sector, most recently the attack against Change Healthcare.

In a filing with the US Securities and Exchange Commission (SEC), pharmaceutical distribution and consulting company Cencora disclosed that a cyberincident resulted in the exfiltration of sensitive personal data from their network. Cencora says they learned of the breach on February 21 and have “not yet determined whether the incident is reasonably likely to materially impact [their] financial condition or results of operations.”

In a joint advisory, law enforcement and cybersecurity-related agencies from 11 countries warn that Russian state-sponsored hackers are likely to continue to use compromised Ubiquiti EdgeRouters to conduct malicious activity. The threat actors are known to have abused the devices “to harvest credentials, collect NTLMv2 digests, proxy network traffic, and host spear-phishing landing pages and custom tools.” In January, the agencies disrupted a botnet of the compromised routers. This advisory warns that the threat actors are likely to do the same thing again and urges owners of the routers to take steps to protect their devices from compromise. Recommended actions include performing a hardware factory reset, upgrading to the most recent version of firmware, changing default usernames and passwords, and implementing strategic firewall rules on WAN-side interfaces.

On Wednesday, February 28, the White House issued an executive order (EO) banning the sale of sensitive personal data to “countries of concern.” As per the order, the Justice Department (DoJ) will initiate a rulemaking process to establish a data security policy; there will be opportunity for public comment. The US Attorney General will work with the Departments of State and Commerce to determine which countries will be affected by the policy.

Cloned versions of legitimate repositories with obfuscated malicious code have made their way onto GitHub. The malware steals passwords and cryptocurrency. While GitHub is able to detect automation and remove bad repositories, some are still missed, and the process doesn’t address those that were uploaded manually. The campaign was detected by researchers at Apiiro.

In February, the US Department of Energy (DOE) announced its intent to gather information from large cryptomining operations to assess the level of energy consumption the industry is demanding. On February 23, a judge in Texas issued a restraining order against the DOE prompted by a lawsuit filed by cryptomining companies. The DOE’s decision to collect the information was an emergency order rather than regular rulemaking, which normally takes much longer. The lawsuit maintains that completing the DOE’s survey would be costly and time consuming and that it would risk exposing confidential information.

On Wednesday, February 28, Cisco released fixes for five vulnerabilities affecting several of their products. Two denial-of-service vulnerabilities, both of which affect Cisco NX-OS software, are rated high-severity. The other three vulnerabilities are rated medium severity; they affect Cisco UCS 6400 and 6500 Series Fabric Interconnects, Cisco Nexus 3000 and 9000 Series Switches, and the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software.

The US Department of Energy is devoting $45 million in funding for 16 projects focused on “develop[ing] tools and technologies to reduce cyber risks to energy infrastructure.” Projects chosen by the DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) cover six topic areas: Automated Cyberattack Prevention and Mitigation, Security and Resiliency by Design, Authentication Mechanisms for Energy Delivery Systems, Automated Methods to Discover and Mitigate Vulnerabilities, Cybersecurity through Advanced Software Solutions, and Integration of New Concepts and Technologies with Existing Infrastructure. They include both academic research institutions and private sector organizations.

North Korean state-sponsored threat actors have exploited a known privilege elevation vulnerability in the Windows AppLocker driver to disable security software in compromised machines. The flaw was detected by researchers from Avast, who reported the issue to Microsoft. The vulnerability was fixed in Microsoft’s February security release.

Hochschule Kempten in Kempten, Germany says its network has suffered a cyberattack on its IT infrastructure. The school “has shut down large parts of the IT infrastructure” as a precaution, and is currently unreachable by eMail, although the telephone system is operational. Hochschule Kempten is a university of applied sciences.

The Wired staff offers a rundown of security updates released during the month of February 2024, including Microsoft’s Patch Tuesday, Google’s Android Security Bulletin, as well as fixes for vulnerabilities in Ivanti products, Fortinet products, and the Firefox and Chrome browsers.

Japan’s Computer Emergency Response Team Coordination Center (JPCERT/CC) has published an alert warning that the Lazarus threat actor group has released malicious packages to the Python Package Index (PyPI). The four identified malicious PyPI packages have more than 3,200 downloads, collectively.

California-based law firm Houser LLP has disclosed that it suffered a cybersecurity incident resulting in the compromise of sensitive information belonging to more than 325,000 individuals. On May 9, 2023, Houser learned that certain files on their systems had been encrypted. An investigation revealed that some of the files has been copied and exfiltrated. Houser is a national litigation law firm with offices in 11 US states.