Organizations big and small are falling prey to the mass exploitation of a critical vulnerability in a widely used file-transfer program. The exploitation started over the Memorial Day holiday—while the critical vulnerability was still a zeroday—and continues now, some nine days later.
As of Monday evening, payroll service Zellis, the Canadian province of Nova Scotia, British Airways, the BBC, and UK retailer Boots were all known to have had data stolen through the attacks, which are fueled by a recently patched vulnerability in MOVEit, a file-transfer provider that offers both cloud and on-premises services. Both Nova Scotia and Zellis had their own instances or cloud services breached. British Airways, the BBC, and Boots were customers of Zellis. All of the hacking activity has been attributed to the Russian-speaking Clop crime syndicate.
Widespread and rather substantial
Despite the relatively small number of confirmed breaches, researchers monitoring the ongoing attacks are describing the exploitation as widespread. They liken the hacks to smash-and-grab robberies, in which a window is broken and thieves grab whatever they can, and warned that the quick-moving heists are hitting banks, government agencies, and other targets in alarmingly high numbers.
“We have a handful of customers that were running MOVEit Transfer open to the Internet, and they were all compromised,” Steven Adair, president of security firm Volexity, wrote in an email. “Other folks we have talked to have seen similar.”
Adair continued:
I do not want to categorize our customers at this point since I do not know what all is out there in terms of who is running the software and give them away. With that said, though—it’s both massive and small organizations that have been hit. The cases we have looked into have all involved some level of data exfiltration. The attackers typically grabbed files from the MOVEit servers less than two hours after exploitation and shell access. We believe this was likely widespread and a rather substantial number of MOVEit Transfer servers that were running Internet-facing web services were compromised.
Caitlin Condon, a senior manager of security research who leads the research arm of security firm Rapid7, said normally her team reserves the term “widespread threat” for events involving “many attackers, many targets.” The attacks under way have neither. So far there’s only one known attacker: Clop, a Russian-speaking group that’s among the most prolific and active ransomware actors. And with the Shodan search engine indexing just 2,510 Internet-facing MOVEit instances when the attacks began, it’s fair to say there aren’t “many targets,” relatively speaking.
In this case, however, Rapid7 is making an exception.
“We aren’t seeing commodity threat actors or low-skill attackers throwing exploits here, but the exploitation of available high-value targets globally across a wide range of org sizes, verticals, and geo-locations tips the scale for us on classifying this as a widespread threat,” she explained in a text message.
She noted that Monday was only the only third business day since the incident became widely known and many victims may only now be learning they were compromised. “We expect to see a longer list of victims come out as time goes on, particularly as regulatory requirements for reporting come into play,” she wrote.
Independent researcher Kevin Beaumont, meanwhile, said on social media on Sunday night: “I’ve been tracking this—there are a double-digit number of orgs who had data stolen, that includes multiple US Government and banking orgs.”
The MOVEit vulnerability stems from a security flaw that allows for SQL injection, one of the oldest and most common classes of exploit. Often abbreviated as SQLi, these vulnerabilities usually stem from a failure by a Web application to adequately scrub search queries and other user input of characters that an app might consider a command. By entering specially crafted strings into vulnerable website fields, attackers can trick a Web app into returning confidential data, giving administrative system privileges, or subverting the way the app works.
Timeline
According to a post published by security firm Mandiant on Monday, the first signs of the Clop exploitation spree occurred on May 27. In some cases data theft occurred within minutes of the installation of a custom webshell tracked as LemurLoot, the researchers said. They added:
Mandiant is aware of multiple cases where large volumes of files have been stolen from victims’ MOVEit transfer systems. LEMURLOOT can also steal Azure Storage Blob information, including credentials, from the MOVEit Transfer application settings, suggesting that actors exploiting this vulnerability may be stealing files from Azure in cases where victims are storing appliance data in Azure Blob storage, although it is unclear if theft is limited to data stored in this way.
The webshell is disguised with filenames such as “human2.aspx” and “human2.aspx.lnk” in an attempt to masquerade as human.aspx, a legitimate component of the MOVEit Transfer service. Mandiant also said it has “observed several POST requests made to the legitimate guestaccess.aspx file before interaction with the LEMURLOOT webshell, indicating SQLi attacks were directed towards that file.”
On May 31, four days after the earliest attacks began, MOVEit provider Progress patched the vulnerability. Within a day, social media posts surfaced reporting that the vulnerability was under exploit by a threat actor who was installing a file named human2.aspx in the root directory of vulnerable servers. Security firms soon confirmed the reports.
Formal attribution that Clop is behind the attacks came on Sunday from Microsoft, which linked the attacks to “Lace Tempest,” the name that company researchers use to track a ransomware operation that maintains the extortion website for the Clop ransomware group. Mandiant, meanwhile, found that tactics, techniques, and procedures used in the attack matched those of a group tracked as FIN11, which has deployed Clop ransomware in the past.
Clop is the same threat actor that mass exploited CVE-2023-0669, a critical vulnerability in a different file-transfer service known as GoAnywhere. That hacking spree allowed Clop to fell data security company Rubrik, obtain health information for one million patients from one of the biggest hospital chains, and (according to Bleeping Computer) take credit for hacking 130 organizations. Research from security firm Huntress has also confirmed that the malware used in intrusions exploiting CVE-2023-0669 had indirect ties to Clop.
So far, there are no known reports of victims receiving ransom demands. The Clop extortion site has also made no mention so far of the attacks. “If the goal of this operation is extortion,” researchers from Mandiant wrote, “we anticipate that victim organizations could receive extortion emails in the coming days to weeks.”