Several U.S. government agencies have fallen victim to cyberattacks due to a security vulnerability found in a widely-used file transfer tool, according to an official confirmation by the U.S. government. The Cybersecurity and Infrastructure Security Agency (CISA) revealed that the attacks were linked to the Clop ransomware gang, believed to have ties to Russia. The targeted tool, MOVEit Transfer, developed by Progress Software, has been exploited by the hackers to gain unauthorized access to affected agencies.
While CISA did not disclose the exact number or names of the impacted agencies, the Department of Energy (DoE) acknowledged that two of its entities were breached. Prompt action was taken by the DoE to mitigate the vulnerability and alert CISA, law enforcement, and the affected parties. Notably, the breach exposed personally identifiable information, potentially affecting tens of thousands of individuals, including Energy employees and contractors.
Among the various U.S. agencies with active MOVEit contracts, the Federal Data Procurement System identified approximately a dozen, including the Department of the Army, the Department of the Air Force, and the Food and Drug Administration. CISA Director Jen Easterly assured that urgent efforts are underway to comprehend the extent of the impacts and facilitate swift remediation. While it remains uncertain whether data has been stolen, Easterly emphasized that the cyber intrusions do not appear to be motivated by targeting specific high-value information or establishing persistent access.
Clop, on its dark web leak site, has denied extorting or releasing any stolen data from U.S. government agencies. The ransomware group claimed that government data had been wiped, but it has added a fresh batch of organizations to its list of victims, purportedly compromised through the MOVEit vulnerability. The latest victims include the Boston Globe, East Western Bank based in California, biotechnology company Enzo Biochem in New York, and Nuance, an AI firm owned by Microsoft.
Progress Software has taken immediate action to address the situation by releasing a patch to resolve the newly discovered vulnerability (CVE-2023-35708) affecting MOVEit Transfer. The flaw could potentially grant unauthorized access to customer environments, as highlighted in the advisory issued by the company.
As the full scale of the cyberattacks continues to unfold, it is crucial for affected agencies and organizations to remain vigilant and implement necessary measures to safeguard their systems and sensitive information.