The US Department of Energy and several other federal agencies were compromised in a Russian cyber-extortion gang’s global hack of a file-transfer program popular with corporations and governments. Still, the impact was not expected to be great, Homeland Security officials said on 15 June 2023. But for others, among what could be hundreds of victims from industry to higher education, including patrons of at least two state motor vehicle agencies, the hack was beginning to show some serious impacts.[1]
Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency (CISA), told reporters that unlike the meticulous, stealthy SolarWinds hacking campaign attributed to state-backed Russian intelligence agents that were months in the making, this campaign was short, relatively superficial, and caught quickly. “Based on discussions we have had with industry partners … these intrusions are not being leveraged to gain broader access, to gain persistence into targeted systems, or to steal specific high-value information— in sum, as we understand it, this attack is largely an opportunistic one,” Easterly said. “Although we are very concerned about this campaign and working on it urgently, this is not a campaign like SolarWinds that presents a systemic risk to our national security or our nation’s networks,” she added.
A senior CISA official said neither the US military nor the intelligence community was affected. Energy Department spokesperson Chad Smith said two agency entities were compromised but did not provide more detail. Known victims to date include Louisiana’s Office of Motor Vehicles, Oregon’s Department of Transportation, the Nova Scotia provincial government, British Airways, the British Broadcasting Company, and the U.K. drugstore chain Boots. The exploited program, MOVEit, is widely used by businesses to share files securely. Security experts say that can include sensitive financial and insurance data.
See: https://redskyalliance.org/xindustry/moveit-tech-talk
Louisiana officials said that people with a driver’s license or vehicle registration in the state likely had their personal information exposed. That included their name, address, Social Security number, and birthdate. They encouraged Louisiana residents to freeze their credit to guard against identity theft.
The Oregon Department of Transportation confirmed last week that the attackers accessed some sensitive personal information for about 3.5 million people to whom state-issued identity cards or driver’s licenses were issued.
The Cl0p ransomware syndicate behind the hack announced on its dark website that its victims, who it suggested numbered in the hundreds, had until 21 June 2023 to get in touch to negotiate a ransom or risk having sensitive stolen data dumped online. The gang, among the world’s most prolific cybercrime syndicates, also claimed it would delete any data stolen from governments, cities, and police departments.
The senior CISA official told reporters a “small number” of federal agencies were hit, declining to name them, and said, “This is not a widespread campaign affecting a large number of federal agencies.” The official, speaking on condition of anonymity to discuss the breach, said no federal agencies had received extortion demands, and no data from an affected federal agency had been leaked online by Cl0p. US officials “have no evidence to suggest coordination between Cl0p and the Russian government,” the official said.
The parent company of MOVIEit’s US maker, Progress Software, alerted customers to the breach on 31 May 2023 and issued a patch. But cybersecurity researchers say scores, if not hundreds of companies, could have had sensitive data quietly exfiltrated by then. “At this point, we are seeing industry estimates of several hundred victims across the country,” the senior CISA official said. Federal officials encouraged victims to come forward, but they often don’t. The US lacks a federal data breach law, and disclosure of hacks varies by state. Publicly traded corporations, healthcare providers, and critical infrastructure purveyors have regulatory obligations.
Cyber security investigators detected 2,500 vulnerable MOVEit servers across 790 organizations, including 200 government agencies. It said it was not able to break down those agencies by country. The hackers were actively scanning for targets, penetrating them, and stealing data as far back as 29 March 2023.
According to federal contracting data, the Office of the Comptroller of the Currency in the Treasury Department uses MOVEit. Spokeswoman Stephanie Collins said the agency was aware of the hack and has been monitoring the situation closely. She said it was “conducting detailed forensic analysis of system activity and has not found any indications of a breach of sensitive information.” She would not say how the agency uses the file-transfer program.
This is far from the first time Cl0p (Clop) breached a file-transfer program to gain access to data it could use to extort companies. Other instances include GoAnywhere servers in early 2023 and Accellion File Transfer Application devices in 2020 and 2021.
The Associated Press emailed Cl0p asking what government agencies it had hacked. It did not receive a response, but the gang posted a new message on its dark web leak site: “We got a lot of emails about government data, we don’t have, it we have completely deleted this information, we, are only interested in business.”
Cybersecurity experts say the Cl0p criminals are not to be trusted to keep their word. Investigators following this cyber group are aware of at least three cases in which data stolen by ransomware crooks appeared on the dark web six to 10 months after victims paid a ransom. Cl0p ransomware is a variant of a previously known strain called CryptoMix. In 2019, Cl0p was delivered as the final payload of a phishing campaign associated with the financially motivated actor TA505. The threat actors would send phishing emails, leading to a macro-enabled document that would drop a loader named Get2. This loader can download tools this group uses, such as SDBot, FlawedAmmy, or FlawedGrace. After the threat actors obtain the initial foothold on the system, they start employing reconnaissance, lateral movement, and exfiltration techniques to prepare for the ransomware deployment. SDBot has been observed delivering Cl0p as the final payload.
This article is presented at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
[1] https://www.securityweek.com/a-russian-ransomware-gang-breaches-the-energy-department-and-other-federal-agencies/
Comments