Change Healthcare breached via Citrix portal with no MFA

UnitedHealth Group confirmed that the BlackCat/Alphv ransomware group breached Change Healthcare in February by using compromised credentials for a Citrix remote access portal that did not have multifactor authentication enabled.

On Monday, a prepared statement from UnitedHealth Group CEO Andrew Witty, titled "Examining the Change Healthcare Cyberattack," was released ahead of Wednesday's House Energy and Commerce Committee Subcommittee on Oversight and Investigations hearing. Witty reconfirmed that Alphv/BlackCat was behind the attack against its tech subsidiary Change Healthcare, which provides a variety of services including financial and administrative management to medical facilities and pharmacies.

On Feb. 21, Change Healthcare disclosed that it was experiencing network disruptions that subsequently affected patients, healthcare providers and pharmacists for months. Since then, UnitedHealth confirmed that Alphv/BlackCat was behind the attack and that the company paid a ransom. UnitedHealth also acknowledged that threat actors had obtained sensitive data.

Witty's opening statement for the hearing shed more light on the attack timeline and vector, though many questions remain.

"On February 12, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal, an application used to enable remote access to desktops. The portal did not have multi-factor authentication. Once the threat actor gained access, they moved laterally within the systems in more sophisticated ways and exfiltrated data. Ransomware was deployed nine days later," Witty said in the prepared statement.

Vulnerable Citrix products have been popular targets for attackers for some time. In November, CISA and the FBI warned organizations that the LockBit ransomware group was widely exploiting a critical Citrix NetScaler ADC and NetScaler Gateway vulnerability, tracked as CVE-2023-4966 and dubbed "Citrix Bleed," that was disclosed and patched in October.

The advisory connected an October attack against aviation giant Boeing to Citrix Bleed. Boeing confirmed that threat actors had exploited CVE-2023-4966 to gain initial access to its parts and distribution business.

Then, in January, Citrix disclosed that two new zero-day vulnerabilities in the same products were under attack, though attribution was not provided. In addition, insurance provider Coalition published its "Cyber Threat Index 2024" in February that highlighted the substantial fallout Citrix Bleed victims faced.

However, the attack on Change Healthcare apparently did not involve the exploitation of Citrix flaws, as the attackers simply used compromised credentials to gain an initial foothold in the company's network.

MFA is a standard security measure that the industry and government agencies have been pushing for years to mitigate the threat of compromised credentials. Several recent, high-profile attacks have seen threat actors targeting and compromising services and assets that lack MFA protection. For example, an investigation into the Midnight Blizzard attack against Microsoft in July revealed that the compromised cloud tenant did not have MFA enabled.