Rising Cyber Threats: Uncovering the Third MOVEit Transfer Vulnerability and Cl0p Gang’s Extortion Methods

The recent disclosure of a new vulnerability impacting Progress Software’s MOVEit Transfer application has highlighted the critical need for robust security measures and timely patching. The revelation comes at a time when the Clop ransomware gang has been exploiting multiple vulnerabilities in the software to target a wide range of organizations, including US federal agencies.

In this article, we will examine the details of the newly disclosed vulnerability and its potential impact, as well as the previous vulnerabilities exploited by the Clop ransomware gang. Additionally, we will look at statistics on the industry and location of exposed hosts running MOVEit and analyze the prevalence of different types of malware, including ransomware.

Progress Software’s Third Vulnerability Disclosure

Progress Software recently disclosed a third vulnerability impacting its MOVEit Transfer application. This time, the vulnerability is an SQL injection vulnerability that “could lead to escalated privileges and potential unauthorized access to the environment.”

The company has urged customers to disable all HTTP and HTTPS traffic to MOVEit Transfer on ports 80 and 443 to safeguard their environments while a patch is being prepared. The urgency of this recommendation is compounded by the fact that the Clop ransomware gang has already been exploiting vulnerabilities in the software.

Details of the new SQL injection vulnerability and potential impact

The new SQL injection vulnerability could have serious consequences for affected organizations. SQL injection attacks are among the most common and damaging types of attacks. They can lead to data breaches, data loss, and even system takeover.

The vulnerability was discovered by security professionals who were assessing the software for potential weaknesses. They found that it was possible to inject SQL queries into the application’s database, which could lead to privileged access to the environment. If exploited, this vulnerability could allow an attacker to take over the system, access sensitive data, and cause significant damage to the targeted organization.

Previously discovered vulnerabilities were exploited by the Clop ransomware gang

This latest vulnerability follows two previous SQL injection vulnerabilities that were disclosed by Progress Software in July 2021. These vulnerabilities were also exploited by the Clop ransomware gang, who used them to steal data from the customers of the software.

The Clop actors have listed the names of 27 companies that they claim were hacked using the MOVEit Transfer flaw on their darknet leak portal, including multiple US federal agencies. This highlights the critical need for timely patching and robust security measures to protect against such threats.

Statistics on the industry and location of exposed hosts running MOVEit

According to Censys, a web-based search platform for assessing the attack surface of internet-connected devices, nearly 31% of over 1,400 exposed hosts running MOVEit are in the financial services industry. This suggests that attackers are targeting organizations with high-value data and assets.

Additionally, nearly 80% of the servers running MOVEit are based in the US, according to Censys. This further underscores the urgency of taking steps to secure the software against attacks.

Analysis of ransomware attacks compared to other types of malware

According to a recent analysis by Kaspersky, ransomware leads with a 58% share, followed by information stealers (24%), and botnets, loaders, and backdoors (18%). This highlights the growing risk of ransomware attacks and emphasizes the need for organizations to adopt robust security measures to protect against them.

Increased Accessibility of MaaS Schemes for Attackers

One factor that is contributing to the rise of ransomware attacks is the increasing accessibility of malware-as-a-service (MaaS) schemes. MaaS allows less technically proficient attackers to enter the fray, thereby lowering the bar for carrying out such attacks.

The revelation of a new vulnerability in Progress Software’s MOVEit Transfer application underscores the need for timely patching and adoption of robust security measures. With the Clop ransomware gang already exploiting previous vulnerabilities in the software, the risk of data breaches and system takeovers is high. Organizations should disable all HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443 and implement additional security measures to protect against possible attacks.

Explore more

Can Federal Lands Power the Future of AI Infrastructure?

I’m thrilled to sit down with Dominic Jainy, an esteemed IT professional whose deep knowledge of artificial intelligence, machine learning, and blockchain offers a unique perspective on the intersection of technology and federal policy. Today, we’re diving into the US Department of Energy’s ambitious plan to develop a data center at the Savannah River Site in South Carolina. Our conversation

Can Your Mouse Secretly Eavesdrop on Conversations?

In an age where technology permeates every aspect of daily life, the notion that a seemingly harmless device like a computer mouse could pose a privacy threat is startling, raising urgent questions about the security of modern hardware. Picture a high-end optical mouse, designed for precision in gaming or design work, sitting quietly on a desk. What if this device,

Building the Case for EDI in Dynamics 365 Efficiency

In today’s fast-paced business environment, organizations leveraging Microsoft Dynamics 365 Finance & Supply Chain Management (F&SCM) are increasingly faced with the challenge of optimizing their operations to stay competitive, especially when manual processes slow down critical workflows like order processing and invoicing, which can severely impact efficiency. The inefficiencies stemming from outdated methods not only drain resources but also risk

Structured Data Boosts AI Snippets and Search Visibility

In the fast-paced digital arena where search engines are increasingly powered by artificial intelligence, standing out amidst the vast online content is a formidable challenge for any website. AI-driven systems like ChatGPT, Perplexity, and Google AI Mode are redefining how information is retrieved and presented to users, moving beyond traditional keyword searches to dynamic, conversational summaries. At the heart of

How Is Oracle Boosting Cloud Power with AMD and Nvidia?

In an era where artificial intelligence is reshaping industries at an unprecedented pace, the demand for robust cloud infrastructure has never been more critical, and Oracle is stepping up to meet this challenge head-on with strategic alliances that promise to redefine its position in the market. As enterprises increasingly rely on AI-driven solutions for everything from data analytics to generative