Microsoft says Clop ransomware gang is behind MOVEit mass-hacks, as first victims come forward
Reading Time: 2 minutesSecurity researchers have linked to the notorious Clop ransomware gang a new wave of mass-hacks targeting a popular file transfer tool, as the first victims of the attacks begin to come forward.
It was revealed last week that hackers are exploiting a newly discovered vulnerability in MOVEit Transfer, a file-transfer tool widely used by enterprises to share large files over the internet. The vulnerability allows hackers to gain unauthorized access to an affected MOVEit server’s database. Progress Software, which develops the MOVEit software, has already released some patches.
Over the weekend, the first victims of the attacks began to come forward.
Zellis, a U.K.-based human resources software maker and payroll provider, confirmed in a statement that its MOVEit system was compromised, with the incident affecting a ‘small number’ of its corporate customers.
British Airways didn’t confirm how many employees are affected, but currently has around 35,000 staff worldwide.
The government of Nova Scotia, which uses MOVEit to share files across departments, said in a statement that some citizens’ personal information may have been compromised. The Nova Scotia government said it took its affected system offline, and is working to determine ‘exactly what information was stolen, and how many people have been impacted.’
It was initially unclear who was behind this new wave of hacks, but Microsoft security researchers are attributing the cyberattacks to a group it tracks as ‘Lace Tempest.’ This gang is a known affiliate of the Russia-linked Clop ransomware group, which was previously linked to mass-attacks exploiting flaws in Fortra’s GoAnywhere file transfer tool and Accellion’s file transfer application.
Microsoft researchers said that the exploitation of the MOVEit vulnerability is often followed by data exfiltration.
Mandiant isn’t yet making the same attribution as Microsoft, but noted in a blog post over the weekend that there are ‘notable’ similarities between a newly created threat cluster it’s calling UNC4857 that has as-of-yet ‘unknown motivations,’ and FIN11, a well-established ransomware group known to operate Clop ransomware. ‘Ongoing analysis of emerging activity may provide additional insights,’ Mandiant said.
It’s likely many more victims of the MOVEit breach will come to light over the next few days.
Shodan, a search engine for publicly exposed devices and databases, showed that more than 2,500 MOVEit Transfer servers were discoverable on the internet.
Reference: https://techcrunch.com/2023/06/05/microsoft-clop-moveit-hacks-victims/
Ref: techcrunch
MediaDownloader.net -> Free Online Video Downloader, Download Any Video From YouTube, VK, Vimeo, Twitter, Twitch, Tumblr, Tiktok, Telegram, TED, Streamable, Soundcloud, Snapchat, Share, Rumble, Reddit, PuhuTV, Pinterest, Periscope, Ok.ru, MxTakatak, Mixcloud, Mashable, LinkedIn, Likee, Kwai, Izlesene, Instagram, Imgur, IMDB, Ifunny, Gaana, Flickr, Febspot, Facebook, ESPN, Douyin, Dailymotion, Buzzfeed, BluTV, Blogger, Bitchute, Bilibili, Bandcamp, Akıllı, 9GAG