A Citrix portal without MFA, and nine days to ransomware
ALPHV/BlackCat operators logged into a Change Healthcare Citrix remote access portal on 12 February 2024 using stolen credentials. The portal had no multi-factor authentication. They moved laterally for nine days and deployed ransomware, disrupting roughly a third of US healthcare transactions and ultimately affecting around 190 million people.
What worked
Very little on the technical side, and the honest reading of this case is that the containment decision was the only thing that went right: the systems were taken offline decisively rather than being left running while the scope was argued about. That call limited the encryption, and it is why this was a catastrophic outage rather than a total one.
What failed
A single-factor internet-facing remote access portal, reached with credentials the attackers already had. Nine days of lateral movement produced no detection that stopped them. The dependency concentration then turned one company's identity gap into a national outage: pharmacies could not process claims, and providers went unpaid for weeks.
The number
9 days
between the first login on the MFA-less Citrix portal and ransomware deployment.
What to do instead
Enumerate every internet-facing authentication surface and prove MFA on each one, from the outside, by testing it rather than by reading the policy. The gap is almost never the main SSO; it is the legacy portal, the vendor appliance, the acquisition that was never folded in. Then ask the question this case actually poses: if you were unavailable for three weeks, who else stops working? That answer belongs to the business, and it is worth more than another detection rule.