Cl0p Extortion: A Review of the Events Around the MOVEit Zero-Day Vulnerability
Executive Summary
- A vulnerability in Progress Software’s MOVEit software, assigned with the CVE identifier CVE-2023-34362, was announced on May 31st, 20231
- On June 5th, 2023, the notorious Cl0p ransomware group claimed responsibility for compromising and stealing data from hundreds of MOVEit users, including confidential client data.
- The Cl0p ransomware group demanded that the MOVEit victims contact them by June 14th, 2023, or else they would start publishing the names of the victim organizations.
- On June 14th, 2023, the Cl0p group began to publish the names of victims.
- Several US federal agencies such as the Department of Energy have come forward and confirmed they were impacted.2 Cl0p claims that they delete all government data.
- As of June 29th, 2023 Cl0p has posted a total of 87 victims (some of which have been removed) across multiple industries worldwide. A handful of these victims have seen their data leaked. Included in the leaked data are Big 4 account firms Ernst & Young and PWC.
Background
A vulnerability in Progress Software’s MOVEit software, assigned with the CVE identifier CVE-2023-34362, was announced on May 31st, 2023. The vulnerability affects MOVEit software by allowing potential unauthorized access and escalated privileges in an unauthenticated manner via different types of SQL injections.
Cl0p Group Claims Responsibility
On June 5th, 2023, the Cl0p ransomware group claimed responsibility for compromising and stealing data from hundreds of MOVEit users, including confidential client data. For example, Zellis, an HR firm, was one of the victims, whose compromised data includes employee data of the BBC and British Airways, among others.3 Additionally, several US federal agencies such as the Department of Energy have come forward and confirmed they were impacted.4
In an unusual move likely related to the large number of victims, rather than directly contacting the victims, the Cl0p ransomware group demanded that the MOVEit victims contact them by June 14th, 2023, or else they would start to publish the names of the victim organizations. If the victims refuse to pay the ransom demand, the group threatened to publish the confidential data that has been exfiltrated.
When news broke about a few government agencies acknowledging that they were compromised, the group immediately responded by posting the following message:
PS. If you are a government, city or police service do not worry, we erased all your data. You do not need to contact us. We have no interest to expose such information.
On June 22nd, 2023, Cl0p made another post on their shame website, most likely due to the number of inquiries they have received questioning their access to government data from the MOVEit vulnerability.
In another post, the group reiterated its claim that it is the only group with access to the stolen MOVEit data, and that it is purposely leaking the names of the victims slowly to allow victims ample time to contact them.
As of June 29th, 2023, Cl0p has posted a total of 87 victims (some of which have been removed) across multiple industries. The group also published data belonging to 37 of those victims, most recently including Big 4 accounting firms Ernst & Young and PWC. In contrast, a week ago only six victims had their data published. Another prominent victim named this week was FIS Global, although its data has yet to be published. FIS Global offers a range of services to thousands of financial institutions of all sizes, and as such, there is a risk of possibly significant impact to the financial services industry.
Recommendations
- Cybercriminals will commonly use Tor5 for both initial exploitation and accessing the web shells once deployed. Blocking all Tor exit nodes will increase the difficulty of successfully exploiting a vulnerable MOVEit installation. While there are many other options available to cybercriminals to mask their IP address, many will simply default to using Tor. The current list of Tor exit nodes is easily obtained from the Tor network.
- Utilize a host-based intrusion detection system that specifically monitors the web application directory where MOVEit is installed. This will allow rapid detection of a web shell.
- Implement rate limiting in the web application firewall. If cybercriminals are unsuccessful in installing the web shell, they may still use the SQL injection to extract data from the databases used by MOVEit. Data exfiltration over a SQL injection results in a large number of HTTP requests; implementing rate limiting and automatic IP banning greatly limits the ability of the cybercriminal to meaningfully extract substantial data volumes this way.
2https://www.cnn.com/2023/06/15/politics/us-government-hit-cybeattack/index.html.
3https://www.cnn.com/2023/06/07/tech/clop-russia-moveit-hack-payroll-uk/index.html.
4https://www.cnn.com/2023/06/15/politics/us-government-hit-cybeattack/index.html.
5Free and open-source browser for anonymous communication.