Hackers are actively exploiting a zero-day vulnerability in MOVEit Transfer file transfer software to steal data from organizations.
MOVEit Transfer is a managed file transfer (MFT) solution developed by Ipswitch, a subsidiary of US-based Progress Software Corporation, that allows enterprise to securely transfer files between business partners and customers using SFTP, SCP, and HTTP-based uploads.
Progress MOVEit Transfer is offered as an on-premise solution, managed by the customer, and as a SaaS cloud platform, managed by the developer.
See also: SeroXen RAT malware targets gamers
See also: Horabot botnet: New malicious campaign targets email accounts
Massive Zero-day Exploit for Data Theft
BleepingComputer has learned that threat actors are exploiting a zero-day vulnerability in MOVEit MFT software to perform mass data downloads from organizations.
It is unclear when the exploit was made and which threat actors are responsible for the attacks, but BleepingComputer has been informed that multiple organizations have been breached and their data stolen.
Yesterday, Progress released a security advisory warning customers of a “critical” vulnerability in MOVEit MFT, offering mitigation until patches are installed.
To prevent this, the developers warn administrators to block external traffic on ports 80 and 443 of the MOVEit Transfer Server.
Progress warns that blocking these ports will prevent external access to the web UI, prevent some MOVEit automation tasks from running, block APIs, and prevent the MOVEit Transfer Outlook add-in from working.
However, SFTP and FTP/s protocols can continue to be used for file transfer.
The developers also warn administrators to check the 'c:\\MOVEit Transfer\wwwroot\' folder for unexpected files, including backups and large file downloads.
Based on information obtained by BleepingComputer, large downloads or unexpected backups are possible signs that threat actors have stolen or are in the process of stealing data.
No information has been released about the zero-day vulnerability. However, based on the ports blocked and the designated location for checking for unusual files, it is likely that the flaw is a web-based vulnerability.
Until a patch is released for your version, organizations are strongly advised to terminate any MOVEit migrations and conduct a thorough investigation for compromise before applying the patch and bringing the server back into operation.
Below is the current list of MOVEit Transfer versions for which a patch is available:
Attack details
Cybersecurity firm Rapid7 has stated that the MOVEit Transfer flaw is a SQL injection vulnerability, leading to remote code execution, however, no CVE has been assigned at this time.
Rapid7 states that there are 2,500 exposed MOVEit Transfer servers, the majority of which are located in the United States, and all of these devices used contained the same webshell.
This webshell is called 'human2.asp' [VirusTotal] and is located in the public HTML folder c:\MOVEit Transfer\wwwroot\.
From BleepingComputer's analysis, when the webshell is accessed and the correct password is provided, the script will execute various commands based on the values of the 'X-siLock-Step1', 'X-siLock-Step2', and 'X-siLock-Step3' request headers.
These commands allow the threat actor to download various information from the MOVEit Transfer MySQL server and perform various actions, such as:
- Retrieve a list of saved files, the username that uploaded the files, and their file paths.
- Insert and delete a random user named MOVEit Transfer with the login name 'Health Check Service' and create new MySQL sessions.
- Retrieve information about the configured Azure Blob Storage account, including the AzureBlobStorageAccount, AzureBlobKey, and AzureBlobContainer settings, as described in this Progress help article.
Threat actors can use this information to steal data directly from victims' Azure Blob Storage containers.
- Download files from the server.
MOVEit Transfer administrators have also reported on Reddit that they are also finding many random files named App_Web_<random> .dll, such as App_Web_feevjhtu.dll, after a violation when there should only be one.
Huntress also reports that the following IP addresses have been associated with the attacks:
Cybersecurity researcher Kevin Beaumont says he has been reliably informed that the MOVEit Transfer SaaS platform was also affected by the vulnerability, significantly expanding the base of potential victims.
Information source: bleepingcomputer.com
