Change Healthcare, 2024: a remote access portal without MFA

The attack path, step by step

What the published record says happened at each stage, then our reading of it: what would have stopped the step, what would have caught it in progress, and what a test would have shown first.

1. 1

   Step 1. First access

   Step 1: Stolen credentials and a portal with no second factor

   On 12 February, criminals used compromised credentials to remotely access a Change Healthcare Citrix portal, an application used to enable remote access to desktops. The portal did not have multi-factor authentication.[1]

   In written answers to the Senate, UnitedHealth Group said its policies require MFA on external-facing applications, that it acquired Change Healthcare in late 2022, and that the server at issue was a legacy Change Healthcare server.[2]

   Andrew Witty told senators that the server had not had MFA deployed on it before the attack.[2]

   Would have stopped it

   • MFA, preferably phishing-resistant, on every internet-facing remote access service, enforced at the service itself rather than assumed from policy
   • An inventory of internet-facing services checked against that policy, above all after an acquisition brings in systems built to someone else's standard

   Would have caught it

   • Sign-in anomaly alerts on remote access portals: new locations, new devices, and logins outside a user's normal pattern

   What a test would have shown

   An external penetration test enumerates what is reachable from the internet and tries it. A remote access portal that accepts a password alone is exactly the kind of finding it exists to produce, and an acquisition is the moment to commission one.

2. 2

   Step 2. Moving inside

   Step 2: Nine days between getting in and the ransomware

   Once the threat actor gained access, Witty testified, they moved laterally within the systems in more sophisticated ways and exfiltrated data. Ransomware was deployed nine days later.[1]

   UnitedHealth Group told the Senate in writing that the actor gained access to Change Healthcare's Active Directory server after using privilege escalation techniques.[2]

   Would have stopped it

   • Tiered administration, so that an account used for a remote desktop session cannot reach the directory servers, and privileged accounts that cannot be used from ordinary desktops
   • Segmentation between remote access landing zones and core identity infrastructure

   Would have caught it

   • Alerts on privilege escalation and on any new access to directory servers. Across nine days, each of these is an event a control could be tuned to flag

   What a test would have shown

   This is the assumed-breach question exactly: starting from one remote desktop session, how far does a tester get, and which step raises an alert? The answer comes back as a path, not as a list of vulnerabilities.

3. 3

   Step 3. Acting on objectives

   Step 3: Data out first, then encryption

   UnitedHealth Group told the Senate that between 17 and 20 February 2024 the threat actor exfiltrated protected health information from Change Healthcare's systems.[2]

   On the morning of 21 February, a cybercriminal calling themselves ALPHV or BlackCat deployed a ransomware attack.[1]

   The ransomware infected Change Healthcare's Windows and ESXi systems.[2]

   Not knowing the entry point at the time, UnitedHealth Group immediately severed connectivity with Change's data centres.[1]

   A joint CISA, FBI and HHS advisory, revised in February 2024, reported that of the nearly 70 victims ALPHV had leaked since mid-December 2023, healthcare was the most commonly victimised sector.[4]

   Would have stopped it

   • Egress controls on servers that hold health data, so a bulk transfer has nowhere to go
   • Hypervisor management separated from the Windows domain, with its own credentials, so one domain compromise does not reach the virtualisation layer

   Would have caught it

   • Alerts on unusual outbound volume from systems holding patient data. Here the data left days before the encryption began

   What a test would have shown

   A red team exercise with an agreed exfiltration objective shows, safely, whether a large transfer leaves unnoticed, before a real one does.