Cl0p ransomware group uses zero-day in file transfer app to steal data
source link: https://itwire.com/business-it-news/security/cl0p-ransomware-group-uses-zero-day-in-file-transfer-app-to-steal-data.html
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Tuesday, 06 June 2023 11:01
Cl0p ransomware group uses zero-day in file transfer app to steal data Featured
By Sam Varghese
Data theft using a zero-day in the secure managed file transfer software MOVEit Transfer has been claimed to be carried out by the Cl0p ransomware group, with the incidents starting on 27 May.
The vulnerability was announced by the company that makes the software, Progress Software Corporation on 31 May, according to a post from the Google-owned Mandiant security firm.
Security outfit Rapid7 said in a blog post that the vulnerability, which initially did not have a CVE, was a SQL injection flaw that allowed remote attackers to gain unauthorised access to MOVEit Transfer's database.
"The advisory notes that 'depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements...exploitation of unpatched systems can occur via HTTP or HTTPS'," the post said.
Known victims appear to be in Europe, with Aer Lingus and British payroll and HR solutions provider Zellis confirming they had been hit, the site said A third affected company was British Airways, the CIA-backed site The Record claimed.
Satnam Narang, senior staff research engineer at security shop Tenable, commented: “Recent reports suggest that exploitation of the zero-day vulnerability in MOVEit Transfer is attributed to the Cl0p ransomware group.
"This isn’t surprising when you consider that this falls under the modus operandi of Cl0p: they were also responsible for exploiting zero-days in other file transfer solutions like CVE-2023-0669 in GoAnywhere earlier this year, and four Acellion vulnerabilities (CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104) in late 2020.
“Cl0p has been around since 2019, and while the group has operated using double extortion tactics (data encryption and exfiltration with threat to publish stolen data), they’ve slowly pivoted towards a focus on data exfiltration, as evidenced in the targeting of file transfer solutions.
"In the grand scheme of things, data encryption alone is not enough of an incentive for victim organisations to pay exorbitant ransom demands.
"However, data exfiltration and threats to publish stolen data hold much more weight and are largely what has powered double extortion and ransomware groups to find so much success.
“The writing is on the wall; file transfer solutions are a prime target for the Clop ransomware group, and they are likely to seek out their next target for exploitation in the near future.”
The Rapid7 post said there were roughly 2500 instances of MOVEit Transfer exposed to the public Internet, with most being in the US.
Read 260 times
Please join our community here and become a VIP.
Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here
GARTNER MARKET GUIDE FOR NDR 2022
You probably know that we are big believers in Network Detection and Response (NDR).Did you realise that Gartner also recommends that security teams prioritise NDR solutions to enhance their detection and response?
Picking the right NDR for your team and process can sometimes be the biggest challenge.
If you want to try out a Network Detection and Response tool, why not start with the best?
Vectra Network Detection and Response is the industry's most advanced AI-driven attack defence for identifying and stopping malicious tactics in your network without noise or the need for decryption.
Download the 2022 Gartner Market Guide for Network Detection and Response (NDR) for recommendations on how Network Detection and Response solutions can expand deeper into existing on-premises networks, and new cloud environments.
PROMOTE YOUR WEBINAR ON ITWIRE
It's all about Webinars.Marketing budgets are now focused on Webinars combined with Lead Generation.
If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.
The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.
Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.
We look forward to discussing your campaign goals with you. Please click the button below.
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK