Ransomwarecritical

Understanding Accellion’s FTA Appliance Compromise, DEWMODE, and Its Supply Chain Impact

Recorded Futureby INSIKT GROUPNov 21, 2025 · 00:00 UTC (Nov 21, 2025)9 min read2

Read at recordedfuture.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-27101 CVE-2021-27102 CVE-2021-27103 CVE-2021-27104

Tags: cve-2021-27101 cve-2021-27102 cve-2021-27103 cve-2021-27104 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-27104 +3 related CVEs CVE-2021-27103 CVE-2021-27101 CVE-2021-27102	Unauthenticated OS Command Injection in Accellion FTA Admin Endpoints	9.8 group max	57%	KEVRansomware	Feb 16, 2021 KEV Nov 3, 2021

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
ipv4	194.88.104.24	which a large amount of data was exfiltrated on port 443 to 194.88.104[.]24 and another in which several TCP sessions had IP address
md5	11454bd782bb41db213d415e10a0fb3c	=[encrypted filename] GET requests to /about.html?csrftoken=11454bd782bb41db213d415e10a0fb3c GET requests to /about.html?aid=1000 According to CISA, the

From the original article

9 min read at recordedfuture.com

Editor’s Note : The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF. This report provides a high-level overview of the Accellion File Transfer Appliance compromise and analysis of the DEWMODE webshell employed in the resulting breaches.

Recorded Future

By INSIKT GROUP · recordedfuture.com

Read the full article at Recorded Future

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.