MOVEit Strikes With All Its Power

Indicators of Compromise

APT Groups

Notes

<div><font>The increasing adaptability and danger of malware, particularly Clop ransomware, is evident. It is very important to develop cyber defenses, be careful when using the Internet, and pay attention to software downloads and updates. Clop ransomware specifically targets businesses rather than individual users, and its creators used creative technical solutions to identify victims' language settings and installed programs. However, there have also been instances of poorly coded functionality in ransomware. Caution should be exercised as cybercriminals continue to exploit maliciously programmed malware for financial gain.</font></div><div><font><br></font></div><div><font>While the Cl0p ransomware group claimed credit for these attacks,these techniques are compatible with a broader trend of financial attacks on web servers running vulnerable file transfer software.<br></font></div><div><br></div>

Mitigation

<b><font>Mitigations</font></b><div><font><div style="">All versions of MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) are affected. Progress Software has released an official patch which is available here: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023</div><div style=""><br></div><div style=""><span style="color: var(--q-dark);">However, prior to applying the patch, Progress recommends admins take the following actions.</span><br></div><div style=""><span style="color: var(--q-dark);"><br></span></div><div style=""><ol><li><span style="color: var(--q-dark);">Disable all HTTP and HTTPS traffic to your MOVEit Transfer Environment by setting up your firewall to deny that access to your environment. (Note: it's fine to leave SFTP and FTP ports open as exploitation appears to occur only over HTTP/HTTPS)</span></li><li><span style="color: var(--q-dark);">Review your MOVEit Environment for signs of compromise, including:</span></li></ol></div><div style=""><span style="color: var(--q-dark);"><br></span></div><div style="">Audit and delete any unauthorized files and user accounts.</div><div style=""><br></div><div style=""><span style="color: var(--q-dark);">On the MOVEit Transfer server, look for any new files created in the C:\MOVEitTransfer\wwwroot\ directory.</span><br></div><div style=""><span style="color: var(--q-dark);"><br></span></div><div style=""><span style="color: var(--q-dark);">On the MOVEit Transfer server, look for new files created in the C:\Windows\TEMP\[random]\ directory with a file extension of [.]cmdline</span><br></div><div style=""><br></div><div style="">Remove any unauthorized user accounts.</div><div style=""><br></div><div style="">Review logs for unexpected downloads of files from unknown IPs or large numbers of files downloaded.</div><div style=""><br></div><div style="">Reset service account credentials for affected systems and MOVEit Service Account</div><div style=""><br></div><div style="">3. <span style="color: var(--q-dark);">After these steps, you can apply the patch.</span></div><div style=""><span style="color: var(--q-dark);"><br></span></div><div style="">After the update has been applied, you can re-enable all HTTP and HTTPS traffic to your MOVEit Transfer environment. You'll also want to verify that the compromise has been fully addressed by going back through the actions in Step 2 above.</div><div style=""><br></div><div style=""><div>Additional Detection Options</div><div><br></div><div><span style="color: var(--q-dark);">Search for a user named ‘Health Check Service’ within the MOVEit user database</span><br><span style="color: var(--q-dark);">Examine active sessions within the MOVEit database for the user ‘Health Check Service’</span><br><span style="color: var(--q-dark);">Search you web access logs for requests that contain any request or response headers listed above</span><br></div><div><span style="color: var(--q-dark);"><br></span></div><div>Additional Security Best Practices</div><div><br></div><div><ol><li>Update network firewall rules to only allow connections to the MOVEit Transfer infrastructure from known, trusted IP addresses</li><li>Review and remove any unauthorized accounts</li><li>Update remote access policies to only allow inbound connections from known and trusted IP addresses</li><li>Allow inbound access from trusted entities</li><li>Enable multi-factor authentication</li></ol></div></div></font></div>