A large-scale global cyberattack exploiting a vulnerability in MOVEit Transfer, a managed file transfer software tool, has hit hundreds of organizations, including “a small number” of U.S. federal agencies, according to the Cybersecurity and Infrastructure Security Agency (CISA). The agency and its partners attributed this broad campaign to cybercriminal group CL0P that has claimed responsibility for some of the attacks.

MOVEit is a popular application developed by Progress Software and used by many healthcare, technology, financial and energy companies as well as government agencies. Progress Software first announced the MOVEit Transfer vulnerability (CVE-2023-34362) on May 31, which allows an attacker to perform an SQL injection in the web application and gain access to MOVEit Transfer's database.

Internet-facing MOVEit Transfer web applications were infected with a web shell named LEMURLOOT, which was then used to steal data from underlying MOVEit Transfer databases, CISA explained.

This vulnerability was exploited as early as May 27, causing massive data theft within minutes of deployment of web shells. Then on June 6, the CL0P^_-LEAKS data leak site posted to claim responsibility for this activity and threatened to release stolen data if victims did not pay an extortion fee, according to Mandiant.

The CL0P ransomware group has been targeting managed file transfer services and previously exploited vulnerabilities in the GoAnywhere, SolarWinds Serv-U and Accellion applications to steal data and extort their victims, Akamai noted in a blog post.

MOVEit attack campaign potentially impacts hundreds of victims

For now, the full extent of this attack remains unknown, but a number of organizations in sectors such as financial services, healthcare, education, technology and government, have been disclosed as victims of the attack.

Johns Hopkins University and its health system, BBC, British Airways, Shell, and state governments in Minnesota and Illinois and Georgia’s state-wide university system are reportedly among the victims. Some of those incidents involved those organizations' reliance on HR and payroll software supplier Zellis, whose MOVEit system was compromised.

CLoP initially gave victims until June 14, 2023, to contact and discuss the possibility of paying a ransom to prevent their data from being published. However, Mandiant CTO Charles Carmakal noted on LinkedIn that Clop has reached out to victims directly via email. The group has released the first batch of names of organizations it claims to have hacked using the MOVEit vulnerability.

‘A small number' of US federal agencies attacked

CISA today confirmed in a press conference that a small number of U.S. federal agencies were affected by the MOVEit attack, but the agency did not reveal the exact number or the names of the affected agencies.

CISA Director Jen Easterly noted it is an opportunistic campaign rather than targeted at specific high-value information or systems, which hasn’t presented a systemic risk to national security.

“As far as we know these actors are only stealing information that is typically stored on the file transfer application at the precise time that the intrusion occurs … These intrusions are not being leveraged to gain broader access to gain persistence in the targeted system or to steal specific high-value information,” she said.

“In addition, we are not aware of the threat actors threatening to extort or release any data stolen from government agencies. Although we are very concerned about this campaign and working on it with urgency, this is not a campaign like SolarWinds that presents a systemic risk to our national security for our nation's network,” Easterly added.

A CISA senior officer noted that while the intrusions are attributed to the CL0P group, there is currently no evidence suggesting any coordination between CL0P and the Russian government. And there have been no disclosures of information stolen from federal agencies on data leak sites.

As part of their response, CISA, along with the FBI and other cybersecurity industry partners including members of Joint Cyber Defense Collaboratives (JCDC), is taking proactive steps to understand the full scope of this campaign and drive national awareness and urgent mitigation of that vulnerability.

CISA noted that the security industry estimates several hundred victims across the country. And the agency encourages all victims to report their intrusions to CISA and the FBI.

Mitigating the MOVEit Vulnerability

Mandiant warns any organization that used MOVEit in May 2023 could have potentially been exploited by the threat actor.

“A series of patches have been released that organizations should deploy to prevent future attacks,” Carmakal told SDxCentral in an email.

But he pointed out in a LinkedIn post that the claim that organizations that patched CVE-2023-34362 the day it was released were not impacted is a misconception.

That’s why Mandiant recommends “any organization that uses the software to perform forensic analysis to determine if the system was compromised, irrespective of when the patch was applied, because mass exploitation occurred several days before a patch became available,” Carmakal wrote.

Additionally, Akamai pointed out the need for organizations to identify their sensitive internet-facing applications as a critical initial step in mitigating attacks. Organizations also should limit internet access to reduce the attack surface, use a web application firewall (WAF) to protect web-based applications and isolate internet-facing servers from the internal network.