About a week ago, the US Cybersecurity and Infrastructure Security Agency and the FBI sent out a joint advisory warning that a file-transfer product called MOVEit contained a dangerous flaw, one that could allow hackers to steal data from affected systems.
It turned out the problem hit close to home. On Thursday, the agency — called CISA for short — provided an update: The very same flaw in MOVEit had been used to breach several US agencies.
CISA Director Jen Easterly said the agency is providing support to departments affected by the MOVEit attack. She said that “as far as we know” the hackers are only stealing information stored on the MOVEit service, and that the intrusions weren’t being leveraged to gain further access to other parts of networks.
CISA’s announcement was the latest confirmation of what many feared when the first MOVEit-related breaches were disclosed earlier this month — that it could turn into a hacking spree. Though Easterly didn’t name the affected agencies, a contractor at a US national lab and a radioactive waste storage site managed by the Department of Energy were among the victims, according to a person familiar with the matter.
“Upon learning that records from two DOE entities were compromised in the global cyberattack on the file-sharing software MOVEit transfer, DOE took immediate steps to prevent further exposure to the vulnerability,” an agency spokesperson said.
Read More: Cyberattack Hits US National Lab, Nuclear Waste Site
The list of victims includes Shell Plc, the government of Nova Scotia, the UK communications regulator Ofcom, the Minnesota Department of Education, and the Dutch campsite and recreation company Landal GreenParks.
IAG SA’s British Airways, the pharmacy chain Boots and the British Broadcasting Corp. told staff that personal information may have been compromised after a breach of their payroll provider, Zellis.
On Thursday, Progress Software Corp., the company behind MOVEit, said a third party had identified another flaw in the software. Since there isn’t a patch for it yet — creating what is known as a zero-day vulnerability — the company said it had disconnected MOVEit’s cloud service and urged customers to disable web traffic to their own MOVEit servers.
The hacking group that has claimed to be behind the attacks, called Clop, said initially that they had information on hundreds of companies. The flaw in MOVEit’s software allowed the hackers to steal files that companies and organizations had uploaded to it.
Like many other hacking groups, Clop steals data from companies and then threatens to release it on their own leak site on the dark web unless they receive a payment. Clop, which also goes by Cl0p, is the name of a ransomware variant but is sometimes used to describe the hacking group that uses it too.
Read More: Hackers Swap Extortion Tactics, Avoiding Police
The Russian-speaking group had posted a message on its site giving hacking victims until June 14 to start ransom negotiations. The group didn’t appear to publish any data on its site that day, though it listed about a dozen alleged new victims, including a US university, insurance and manufacturing firms, banks, and investment and financial services companies.
MOVEit and other file-transfer applications are designed to submit confidential information securely and fulfill corporate compliance requirements. The systems can be configured to comply with data privacy statues like HIPPA that protect confidential information.
“Your organization depends on transferring mission-critical sensitive data securely and reliably,” according to a video on Progress’s website. “MOVEit can help.”
The company first began investigating the hack on the evening of May 28 after a call to customer support flagged suspicious activity, according to a filing with the US Securities and Exchange Commission.
The investigators found an earlier zero-day vulnerability in the software — one that could set the stage for “unauthorized escalated privileges and access to the customer’s underlying environment,” according to the filing. The company alerted customers and the SEC on May 30.
Progress has issued a patch for that flaw. The cybersecurity firm Huntress helped the company uncover additional problems that could be used by hackers, and a patch was issued for those vulnerabilities as well. “We have not seen indications that these newly discovered vulnerabilities have been exploited,” the company said on June 9.
On Thursday, however, the company announced that a third party had found another zero day, according to an update on Progress’s website. “We are currently testing the patch, and we will update customers shortly,” the company said.
Author: Andrew Martin, Ari Natter and William Turton