Hackers Exploit Accellion Zero-Days in Recent Data Theft and Extortion Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-27104 | Unauthenticated OS Command Injection in Accellion FTA Admin Endpoints CVE-2021-27104 is an OS command injection flaw (CWE-78) in Accellion's File Transfer Appliance (FTA), affecting versions 9_12_370 and earlier. It is triggered by sending a crafted POST request to various admin endpoints, and the CVSS vector (no privileges, no user interaction, network-accessible) indicates it can be exploited by an unauthenticated remote attacker. Successful exploitation yields full OS command execution on the appliance, giving the attacker control sufficient for data theft, web shell deployment, and follow-on ransomware/extortion operations. Organizations running Accellion FTA appliances — typically deployed as internet-facing large-file transfer endpoints by enterprises, government agencies, and universities — are affected. The flaw is being actively exploited in the wild: it was added to CISA's KEV catalog on 2021-11-03 with known ransomware use (notably the Clop/FINEST data-theft extortion campaign, including the breach of security firm Qualys), and it carries a high EPSS score of 56.7% (99th percentile). The fixed version is FTA_9_12_380 and later. Do: Upgrade Accellion FTA to version FTA_9_12_380 or later per vendor instructions; the flaw is on CISA's KEV list with known ransomware use, so patching is urgent for internet-facing appliances. Until patched, restrict or firewall access to FTA admin endpoints from the internet, and review logs and the appliance for signs of command injection or web shell (e.g., DEWMODE-related) compromise given the active data-theft extortion campaign. | 9.8 group max | 57% | KEV ransomware |
| moderate≈1,000-10,000 internet-exposed FTA appliances (enterprise appliance with a customer base in the low thousands of organizations) |
Full article571 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 23, 2021
Cybersecurity researchers on Monday tied a string of attacks targeting Accellion File Transfer Appliance (FTA) servers over the past two months to data theft and extortion campaign orchestrated by a cybercrime group called UNC2546.
The attacks, which began in mid-December 2020, involved exploiting multiple zero-day vulnerabilities in the legacy FTA software to install a new web shell named DEWMODE on victim networks and exfiltrating sensitive data, which was then published on a data leak website operated by the CLOP ransomware gang.
But in a twist, no ransomware was actually deployed in any of the recent incidents that hit organizations in the U.S., Singapore, Canada, and the Netherlands, with the actors instead resorting to extortion emails to threaten victims into paying bitcoin ransoms.
According to Risky Business, some of the companies that have had their data listed on the site include Singapore's telecom provider SingTel, the American Bureau of Shipping, law firm Jones Day, the Netherlands-based Fugro, and life sciences company Danaher.
Following the slew of attacks, Accellion has patched four FTA vulnerabilities that were known to be exploited by the threat actors, in addition to incorporating new monitoring and alerting capabilities to flag any suspicious behavior. The flaws are as follows -
- CVE-2021-27101 - SQL injection via a crafted Host header
- CVE-2021-27102 - OS command execution via a local web service call
- CVE-2021-27103 - SSRF via a crafted POST request
- CVE-2021-27104 - OS command execution via a crafted POST request
FireEye's Mandiant threat intelligence team, which is leading the incident response efforts, is tracking the follow-on extortion scheme under a separate threat cluster it calls UNC2582 despite "compelling" overlaps identified between the two sets of malicious activities and previous attacks carried out by a financially motivated hacking group dubbed FIN11.
"Many of the organizations compromised by UNC2546 were previously targeted by FIN11," FireEye said. "Some UNC2582 extortion emails observed in January 2021 were sent from IP addresses and/or email accounts used by FIN11 in multiple phishing campaigns between August and December 2020."
Once installed, the DEWMODE web shell was leveraged to download files from compromised FTA instances, leading to the victims receiving extortion emails claiming to be from the "CLOP ransomware team" several weeks later.
Lack of reply in a timely manner would result in additional emails sent to a wider group of recipients in the victim organization as well as its partners containing links to the stolen data, the researchers detailed.
Besides urging its FTA customers to migrate to kiteworks, Accellion said fewer than 100 out of 300 total FTA clients were victims of the attack and that less than 25 appear to have suffered "significant" data theft.
The development comes after grocery chain Kroger disclosed last week that HR data, pharmacy records, and money services records belonging to some customers might have been compromised as a result of the Accellion incident.
Then earlier today, Transport for New South Wales (TfNSW) became the latest entity to confirm that it had been impacted by the worldwide Accellion data breach.
"The Accellion system was widely used to share and store files by organisations around the world, including Transport for NSW," the Australian agency said. "Before the attack on Accellion servers was interrupted, some Transport for NSW information was taken."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/02/hackers-exploit-accellion-zero-days-in.html