FOLLOW US

The CLOP ransomware group is one of the numerous gangs in Eastern Europe and Russia. They are typically focused on wringing their victims for as much money as possible.

“The activity we’re seeing at the moment, adding company names to their leak site, is a tactic to scare victims, both listed and unlisted, into paying,” Rafe Pilling, director of threat research at Dell-owned Secureworks, explained.

On Thursday,  Mandiant issued a report on another massive hack that compromised tens of thousands of computers, as well.  It was determined that the Barracuda Networks’ cyberattack was “espionage activity in support of the People’s Republic of China. And no ransom was requested.

MOVEit vulnerabilities

The hackers exploited a vulnerability in MOVEit, a widely-used software for data transfer by companies and agencies. Progress Software, the US-based firm that develops the software, revealed that a new vulnerability had been discovered, which could be exploited by malicious actors.

The company had been warning customers about security flaws for weeks and released a security advisory in early June highlighting the vulnerability and the potential for unauthorized access.

CISA has ordered all federal civilian agencies to update their MOVEit software to mitigate the risk. Progress Software has released two software patches to address the vulnerability and published remediation steps for affected entities.

Allan Liska, a ransomware expert at cybersecurity firm Recorded Future, predicts that the consequences of the data theft will be significant due to the sensitive nature of the data often stored on MOVEit servers. It is believed it will take months to fully understand the extent of the fallout from this massive attack.