![]() ![]() Having been alerted to the flaw and hostile exploitation by Microsoft, SolarWinds said it “mobilized to address it quickly”, issuing a hotfix on July 9. “An attacker could then install programs view, change, or delete data or run programs on the affected system.”Ĭatch up on the latest cyber-attack news and analysis “A threat actor who successfully exploited this vulnerability could run arbitrary code with privileges,” said SolarWinds. The remote memory escape flaw ( CVE-2021-35211) affects both the Serv-U Managed File Transfer Server and Serv-U Secured File Transfer Protocol, according to a security advisory issued by SolarWinds. UPDATED SolarWinds has patched a remote code execution (RCE) vulnerability in its Serv-U file transfer products after Microsoft observed exploitation against “a limited, targeted set of customers” by “a single threat actor”. ![]() Other instances include GoAnywhere servers in early 2023 and Accellion File Transfer Application devices in 20.Enterprise IT software vendor unsure of scope of impact This is far from the first time Cl0p has breached a file-transfer program to gain access to data that it could then use to extort companies. The hackers were actively scanning for targets, penetrating them and stealing data at least as far back as March 29, said SecurityScorecard threat analyst Jared Smith. She said it was “conducting detailed forensic analysis of system activity and has not found any indications of a breach of sensitive information.” Spokeswoman Stephanie Collins said the agency was aware of the hack and has been monitoring the situation closely. The Office of the Comptroller of the Currency in the Treasury Department uses MOVEit, according to federal contracting data. Microsoft says the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global supply chain. It said it was not able to break down those agencies by country.īusiness Russian-backed hackers are targeting cloud services, Microsoft says The cybersecurity firm SecurityScorecard says it detected 2,500 vulnerable MOVEit servers across 790 organizations, including 200 government agencies. Publicly traded corporations, healthcare providers and some critical infrastructure purveyors do have regulatory obligations to fulfill in the event of a hack. lacks a federal data-breach law, and disclosure of hacks varies by state. But cybersecurity researchers say scores, if not hundreds, of companies could by then have had sensitive data quietly exfiltrated.įederal officials encouraged victims to come forward, but they often don’t in such cases. maker, Progress Software, alerted customers to the breach May 31 and issued a patch. officials “have no evidence to suggest coordination between Cl0p and the Russian government,” the official said. ![]() The senior CISA official told reporters that a “small number” of federal agencies were hit - declining to name them - and said that “this is not a widespread campaign affecting a large number of federal agencies.” The official, speaking on condition of anonymity to discuss the breach, said no federal agencies had received extortion demands, and no data from an affected federal agency had been leaked online by Cl0p. is talking cybersecurity this week with 30 countries, but Russia - which some blame for encouraging ransomware attacks - isn’t one of them. is hosting talks on cybersecurity with 30 nations. ![]()
0 Comments
Leave a Reply. |