A new Cybersecurity & Infrastructure Security Agency (CISA) alert advises that, starting in late May, a well-known ransomware group called Clop compromised a widely used managed file transfer (MFT) platform called MOVEit Transfer, reportedly impacting hundreds of companies globally. 

MFT platforms are used to securely transfer files between parties, and Clop reportedly compromised MOVEit Transfer using a previously unknown (zero-day) vulnerability that allowed attackers to steal files from MOVEit’s underlying database. This vulnerability is now tracked as CVE-2023-34362.

Clop has previously targeted MFT platforms such as Accellion and has shown that it is prepared to follow through on threatened next steps.  In this case, Clop is threatening to identify victim companies on the Clop site as soon as June 14 and then, if a ransom is not paid, publish victims’ stolen data.  In prior attacks, Clop has also reportedly contacted victim companies directly with ransom demands, sometimes weeks or more after the attack.  We do not recommend that victims contact threat actors like Clop directly but instead work with experts to do so safely, if necessary.

Organizations that may be victims of this attack should consider the following steps:

1. Organizations that used the MOVEit Transfer platform with its web interface exposed to the internet should consider initiating a privileged investigation to determine if they were impacted by this attack.
2. Organizations with vulnerable MOVEit Transfer systems should consider reviewing available guidance and patching information from Progress Software, the maker of MOVEit Transfer, and be vigilant for additional attempts at exploitation and data theft, as well as other attacks targeting these systems (e.g., the deployment of ransomware encryptors). Progress Software, the maker of MOVEit, has provided information about the vulnerability, patching and recommended mitigation here:  https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability. 
3. If your organization was impacted, assess the attacker’s level of access and what data was compromised.
4. Based on the data compromised, determine your organization’s notification requirements under applicable laws, regulations, and contracts.
5. Organizations should also consider reviewing their supply chains and other counterparties to determine if their data may have been exposed through third parties’ use of the MOVEit Transfer platform.

Crowell & Moring attorneys are monitoring developments and stand ready to support affected businesses.