MOVEit Transfer Exploit Connected to Ransomware Group

A bit of history

• Mandiant reported the initial attacks on May 27, but GreyNoise detected scanning activities potentially linked to this flaw as early as March. 
• In the documented attacks, malicious actors have taken advantage of the vulnerability to deploy a webshell/backdoor, enabling them to pilfer data uploaded by MOVEit Transfer users.

Attribution

• Mandiant linked the activities to a new threat cluster called UNC4857, and identified the webshell delivered as LemurLoot.
• It observed victims in the U.S., Canada, and India, with instances of data theft occurring shortly after the deployment of the webshell.
• Although there are some similarities between UNC4857 and activities associated with FIN11 and Cl0p operations, the firm stated that there is insufficient evidence to draw a definitive conclusion.
• In contrast, Microsoft is confident in attributing the attack to the threat actor responsible for the Cl0p ransomware. The tech giant tracks this group as Lace Tempest and has noted overlaps with the activities of FIN11 and TA505.

Cl0p claims attack

• The ransomware group declined to disclose the exact count of breached organizations in the MOVEit Transfer attacks. However, it stated that if a ransom was not paid, the victims would be publicly listed on the data leak website.
• Additionally, Cl0p corroborated that it has not initiated any extortion efforts against the victims. It is probable that the attackers are utilizing this time to analyze the stolen data and assess its value, strategizing how to effectively leverage it for a ransom demand from the compromised companies.

The bottom line