Extortion Gang Breaches Cybersecurity Firm Qualys Using Accellion Exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-27104 | Unauthenticated OS Command Injection in Accellion FTA Admin Endpoints CVE-2021-27104 is an OS command injection flaw (CWE-78) in Accellion's File Transfer Appliance (FTA), affecting versions 9_12_370 and earlier. It is triggered by sending a crafted POST request to various admin endpoints, and the CVSS vector (no privileges, no user interaction, network-accessible) indicates it can be exploited by an unauthenticated remote attacker. Successful exploitation yields full OS command execution on the appliance, giving the attacker control sufficient for data theft, web shell deployment, and follow-on ransomware/extortion operations. Organizations running Accellion FTA appliances — typically deployed as internet-facing large-file transfer endpoints by enterprises, government agencies, and universities — are affected. The flaw is being actively exploited in the wild: it was added to CISA's KEV catalog on 2021-11-03 with known ransomware use (notably the Clop/FINEST data-theft extortion campaign, including the breach of security firm Qualys), and it carries a high EPSS score of 56.7% (99th percentile). The fixed version is FTA_9_12_380 and later. Do: Upgrade Accellion FTA to version FTA_9_12_380 or later per vendor instructions; the flaw is on CISA's KEV list with known ransomware use, so patching is urgent for internet-facing appliances. Until patched, restrict or firewall access to FTA admin endpoints from the internet, and review logs and the appliance for signs of command injection or web shell (e.g., DEWMODE-related) compromise given the active data-theft extortion campaign. | 9.8 group max | 57% | KEV ransomware |
| moderate≈1,000-10,000 internet-exposed FTA appliances (enterprise appliance with a customer base in the low thousands of organizations) | |
| CVE-2021-27730 +1 in the same advisory: …27731 | Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. Accellion FTA 9_12_432 and earlier is affected by argument injection via a crafted POST request to an admin endpoint. The fixed version is FTA_9_12_444 and later. NVD description · AI analysis pending | 9.8 group max | 1% |
| — |
Full article516 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 04, 2021
Enterprise cloud security firm Qualys has become the latest victim to join a long list of entities to have suffered a data breach after zero-day vulnerabilities in its Accellion File Transfer Appliance (FTA) server were exploited to steal sensitive business documents.
As proof of access to the data, the cybercriminals behind the recent hacks targeting Accellion FTA servers have shared screenshots of files belonging to the company's customers on a publicly accessible data leak website operated by the CLOP ransomware gang.
Confirming the incident, Qualys Chief Information Security Officer Ben Carr said a detailed probe "identified unauthorized access to files hosted on the Accellion FTA server" located in a DMZ (aka demilitarized zone) environment that's segregated from the rest of the internal network.
"Based on this investigation, we immediately notified the limited number of customers impacted by this unauthorized access," Carr added. "The investigation confirmed that the unauthorized access was limited to the FTA server and did not impact any services provided or access to customer data hosted by the Qualys Cloud Platform."
Last month, FireEye's Mandiant threat intelligence team disclosed details of four zero-day flaws in the FTA application that were exploited by threat actors to mount a wide-ranging data theft and extortion campaign, which involved deploying a web shell called DEWMODE on target networks to exfiltrate sensitive data, followed by sending extortion emails to threaten victims into paying bitcoin ransoms, failing which the stolen data was posted on the data leak site.
While two of the flaws (CVE-2021-27101 and CVE-2021-27104) were addressed by Accellion on December 20, 2020, the other two vulnerabilities (CVE-2021-27102 and CVE-2021-27103) were identified earlier this year and fixed on January 25.
Qualys said it received an "integrity alert" suggesting a possible compromise on December 24, two days after it applied the initial hotfix on December 22. The company didn't say if it received extortion messages in the wake of the breach, but said an investigation into the incident is ongoing.
"The exploited vulnerabilities were of critical severity because they were subject to exploitation via unauthenticated remote code execution," Mandiant said in a security assessment of the FTA software published earlier this week.
Additionally, Mandiant's source code analysis uncovered two more previously unknown security flaws in the FTA software, both of which have been rectified in a patch (version 9.12.444) released on March 1 —
- CVE-2021-27730: An argument injection vulnerability (CVSS score 6.6) accessible only to authenticated users with administrative privileges, and
- CVE-2021-27731: A stored cross-site scripting flaw (CVSS score 8.1) accessible only to regular authenticated users
The FireEye-owned subsidiary is tracking the exploitation activity and the follow-on extortion scheme under two separate threat clusters it calls UNC2546 and UNC2582, respectively, with overlaps identified between the two groups and previous attacks carried out by a financially motivated threat actor dubbed FIN11. But it is still unclear what connection, if any, the two clusters may have with the operators of Clop ransomware.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/03/extortion-gang-breaches-cybersecurity.html