CL0P Ransomware Gang Exploits MOVEit Vulnerability

CVE-2023-34362 MoveIT Transfer Vulnerability

According to CISA, The CL0P ransomware gang has exploited a SQL injection, identified as CVE-2023-34362, in the popular MOVEit managed file transfer tool by Progres Software. The internet-facing MOVEit application was infected with a web shell which was then used to exfliltrate data from various MOVEit databases.

FBI and CISA are advising that the risk can be mitigated by performing the following basic best practices:

  • Inventory all assets in your enterprise and produce an inventory of authorized and unauthorized applications.
  • Only grant administrative privileges when absolutely necessary
  • Perform regular and routine monitoring of network traffic
  • Perform regular patching and software updates as part of a patching policy.

The CL0P ransom note, courtesy of CISA:

Hello, this is the CL0P hacker group. As you may know, we recently carried
out a hack, which was reported in the news on site [redacted].
We want to inform you that we have stolen important information from your
GoAnywhere MFT resource and have attached a full list of files as evidence.
We deliberately did not disclose your organization and wanted to negotiate
with you and your leadership first. If you ignore us, we will sell your
information on the black market and publish it on our blog, which receives
30-50 thousand unique visitors per day. You can read about us on [redacted]
by searching for CLOP hacker group.
You can contact us using the following contact information: