{"id":21295,"date":"2023-02-20T16:10:31","date_gmt":"2023-02-21T00:10:31","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/02\/20\/news-15027\/"},"modified":"2023-02-20T16:10:31","modified_gmt":"2023-02-21T00:10:31","slug":"news-15027","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/02\/20\/news-15027\/","title":{"rendered":"GoAnywhere zero-day opened door to Clop ransomware"},"content":{"rendered":"

A semi-active ransomware group has claimed it is behind a string of attacks which have taken advantage of a zero-day vulnerability<\/a> in GoAywhere MFT.<\/p>\n

The Russian-linked Clop ransomware group says it was able to remotely attack private systems using exposed GoAnywhere MFT administration consoles accessible on the public internet. BleepingComputer reports<\/a> the group claimed they gained access and stole data from the GoAnywhere servers of at least 130 organizations.<\/p>\n

One of Clop’s victims was Community Health Systems (CHS), a Fortune 500 healthcare services provider in the US. It recently filed a Form 8-K<\/a> to the Securities and Exchange Commission (SEC), announcing the compromise of its system and disclosure of company data, including protected health information (PHI) and personal information (PI) of certain patients. CHS didn’t disclose the specific number of affected individuals.<\/p>\n

Since the release of the emergency patch, Fortra has revealed that attackers also breached some of its MFTaaS instances during the attack.<\/p>\n

The Cybersecurity & Infrastructure Security Agency (CISA) recently added CVE-2023-0669<\/a> to its Known Exploited Vulnerabilities Catalog<\/a>, a list of software flaws that federal organizations must patch within two weeks. It’s helpful for non-federal organizations to refer to<\/a> as well, in order to help prioritize their patching.<\/p>\n

Thankfully, an emergency patch<\/a> (7.1.2) has been available since last week.<\/p>\n

As well as the patch, GoAnywhere clients are also encouraged to:<\/p>\n