InfoSecBulletin Cybersecurity for mankind
A Russian-speaking cybercrime group has been targeting dozens of companies, including several federal agencies, in a recent spree. The group, CL0P, is known for using a flaw in the MOVEIt file transfer program to steal data.
Among the victims of CL0P’s attacks are the BBC, Shell, Johns Hopkins Health Systems, British Airways, the state of Illinois, and the departments of motor vehicles of Oregon and Louisiana. The group has also claimed to have stolen data from the Department of Energy, but the agency has not confirmed this.
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
ALSO READ:
Trend Micro give special focus on South East Asia, Specially Bangladesh: Kanchan Mallick
CL0P appears to have been able to exploit a flaw in MOVEIt that allows them to access files on computers that are using an outdated version of the program. Once they have access to a computer, they can steal files, encrypt them, and then demand a ransom payment in exchange for decrypting the files.
In a statement posted to its website, CL0P warned companies that they should not store sensitive data on computers that are not properly protected. “If you put data on the internet where data is not protect do not blame us,” the group wrote.
The attacks by CL0P have raised concerns about the security of MOVEIt and the vulnerability of organizations that use the program. The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory warning organizations about the flaw in MOVEIt and urging them to update to the latest version of the program.
It is unclear how many organizations have been affected by CL0P’s attacks, but Wendi Whitmore, who leads a team that tracks ransomware groups for the cybersecurity company Palo Alto Networks, told US media that the group had likely stolen files from “at least hundreds, if not more,” of organizations.
The attacks by CL0P are a reminder of the growing threat posed by ransomware groups. These groups are increasingly sophisticated and are targeting a wider range of organizations. Businesses and organizations of all sizes should take steps to protect themselves from ransomware attacks, including updating software, using strong passwords, and backing up data regularly.
Source: NBC News
