• Source: 2023 MOVEit data breach

A wave of cyberattacks and data breaches began in June 2023 after a vulnerability was discovered in MOVEit, a managed file transfer software.




Background


MOVEit is a managed file transfer software developed by Ipswitch, Inc., a subsidiary of Progress Software.




Methodology


A vulnerability in MOVEit allows attackers to steal files from organizations through SQL injection on public-facing servers. The transfers are facilitated through a custom web shell identified as LemurLoot. Disguised as ASP.NET files used legitimately by MOVEit, LemurLoot can steal Microsoft Azure Storage Blob information.




Discovery


According to cybersecurity firm Mandiant, the MOVEit vulnerability began being used on May 27, 2023.




Responsibility


According to the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation, the breaches are being conducted by Cl0p, a Russian-affiliated cyber gang.




Impact


On June 3, the Government of Nova Scotia estimated that as many as 100,000 present and past employees were impacted by the breach.
On June 5, various organizations in the United Kingdom, including the BBC, British Airways, Boots, Aer Lingus, and payroll service Zellis were breached. On June 12, Ernst & Young, Transport for London, and Ofcom separately announced that they had been affected, with Ofcom announcing that personal and confidential information was downloaded.
On June 15, CNN reported that the United States Department of Energy was among multiple United States government organizations affected by the MOVEit vulnerability. The following day, it was reported that the Louisiana Office of Motor Vehicles and Oregon Driver and Motor Vehicle Services were hit, affecting millions of residents.
A running total maintained by cybersecurity company Emsisoft showed that more than 2,500 organizations were known to have been impacted as at October 25, 2023 with more than 80 percent of those organizations being US-based.




Response


The MOVEit team has worked with industry experts to investigate the May 31 incident. Cybersecurity and Infrastructure Security Agency (CISA), CrowdStrike, Mandiant, Microsoft, Huntress and Rapid7 have assisted with incident response and ongoing investigations. Cyber industry experts have credited the MOVEit team for its response and handling of the incident by quickly providing patches, as well as regular and informative advisories that helped support rapid remediation.




References

Kata Kunci Pencarian:

• 2023 MOVEit data breach
• MOVEit
• Clop (cyber gang)
• Progress Software
• Genworth Financial
• Fur Affinity
• List of security hacking incidents
• JBS S.A. ransomware attack
• Timeline of computing 2020–present
• Emotet