Black Basta

U.S. Senator Ron Wyden has called on the Federal Trade Commission (FTC) to investigate Microsoft for "gross cybersecurity negligence" linked to ransomware attacks on U.S. healthcare networks. In a letter to FTC Chairman Andrew Ferguson, Wyden expressed concerns about Microsoft's cybersecurity practices and its dominant market position, which he believes pose a national security risk. He referenced a ransomware attack on the healthcare system Ascension that affected 5.6 million individuals, attributed to the Black Basta group, and noted that the breach was initiated by a contractor clicking a malicious link on Microsoft's Bing search engine. The attackers exploited insecure default settings in Microsoft software, using a method called Kerberoasting that targets the Kerberos authentication protocol. This method takes advantage of the outdated RC4 encryption technology, which Microsoft still supports. Wyden criticized Microsoft's lack of adequate warnings about the risks associated with RC4 and pointed out that the software does not enforce a minimum password length of 14 characters for privileged accounts. Microsoft plans to phase out RC4 in future updates, with new installations of Active Directory Domains using Windows Server 2025 set to have RC4 disabled by default starting in Q1 of 2026. Additionally, a report from the U.S. Cyber Safety Review Board highlighted preventable errors that allowed Chinese threat actors to compromise Microsoft Exchange Online mailboxes. Despite these cybersecurity issues, Microsoft continues to secure lucrative federal contracts.