Clop ransomware claims to have breached 130 organisations using GoAnywhere zero-day vulnerability

The Clop ransomware gang claims they have successfully attacked approximately 130 organisations by exploiting a zero-day remote code execution vulnerability (CVE-2023-0669) affecting GoAnywhere Managed File Transfer (MFT) software. According to reports, exploiting CVE-2023-0669 allows attackers to execute remote code on unpatched GoAnywhere MFT instances, exposing the administrative consoles of these instances to the internet for arbitrary access.

Clop told news media that they stole data within 10 days after their initial intrusion into servers vulnerable to CVE-2023-0669. Clop also claimed to have successfully moved laterally within target networks and deployed ransomware payloads to encrypt target systems, but they ultimately decided not to do so, instead stealing documents stored on the compromised GoAnywhere MFT servers.

According to reports, when asked when they launched the attacks, whether they had begun extorting victims, and how much ransom they were demanding, they refused to provide evidence or share other details. Media outlets stated they could not independently verify Clop's claims, and Fortra, the developer of GoAnywhere MFT, has not yet replied to inquiries regarding the exploitation of CVE-2023-0669 or with more information about Clop's allegations.

However, research by the Security Assessment Laboratory found that the GoAnywhere MFT attacks are linked to the TA505 threat group, which has been observed deploying Clop ransomware in the past.

Although the link is not definitive, analysis of Truebot's campaigns and deployment mechanisms suggests a link to a group known as TA505. The distributor of the ransomware family is known as Clop, and various reports link Silence/Truebot campaigns to TA505 operations. Based on observed actions and previous reports, we can conclude that the currently observed campaigns are aimed at deploying ransomware, and GoAnywhere MFT also presents potential opportunities for additional exploitation for the same purpose.

The exploitation of CVE-2023-0669 requires no privileges and can be executed via remote code, and has therefore been rated as high risk. The code is public, and there is evidence of in-the-wild exploitation. Fortra has released a fix that reportedly addresses the issue, and immediate patching is recommended.

We suspect that the Clop ransomware and the "CL0P^_-LEAKS" data leak site (DLS) are exclusive to FIN11. Although the threat group has historically conducted widespread phishing campaigns, in recent years, FIN11 has shifted to gaining access by exploiting vulnerabilities in recently public-facing servers.

As reported by the media, this recent campaign is reminiscent of the attacks from late 2020 to early 2021, in which the attack group exploited multiple zero-day vulnerabilities in Accellion legacy File Transfer Appliance (FTA) to install the DEWMODE web shell, which was subsequently used to exfiltrate data published to the CL0P^_-LEAKS DLS.

While this campaign is currently attributed to APT-U2546 and APT-U2582, there is a clear intersection between these threat events and FIN11.

Accessing secure file transfer tools, including Accellion legacy FTA and GoAnywhere MFT instances, may be particularly attractive to attackers conducting data theft extortion operations, as they can exfiltrate sensitive files while occupying only a small footprint on the victim's network.

Although our security researchers believe the recent campaigns targeting GoAnywhere instances are designed to support ransomware deployment, previous campaigns indicate that attackers are more likely to conduct data theft extortion without deploying ransomware.

The Security Assessment Verification Platform has incorporated this technique into its simulated attack library. Search for "clop"/"FIN11" within the platform to access relevant attack simulation experiments, thereby verifying whether the security defense system can effectively counter this attack method.