{"id":92880,"date":"2023-06-15T08:15:00","date_gmt":"2023-06-15T08:15:00","guid":{"rendered":"https:\/\/cloudnewshub.com\/?p=92880"},"modified":"2023-06-15T08:15:00","modified_gmt":"2023-06-15T08:15:00","slug":"clop-begins-naming-alleged-moveit-victims","status":"publish","type":"post","link":"https:\/\/cloudnewshub.com\/?p=92880","title":{"rendered":"Clop begins naming alleged MOVEit victims"},"content":{"rendered":"
<\/div>\n

As it had previously threatened, the Clop cyber crime cartel has started publicly naming victims allegedly compromised via a SQL injection flaw in Progress Software\u2019s MOVEit managed file transfer product<\/a>, who have resisted its extortion attempt.<\/p>\n

Clop, which is believed to be based in Russia, told users of the MOVEit Transfer product last week that they had seven days to comply with its demands<\/a>. This deadline passed yesterday<\/a> (14 June), and true to its word, Clop began to add the details of new victims, up to a total of 12, to its dark web leak site at around 6pm UK time.<\/p>\n

Among the first tranche of names are fuel giant Shell<\/a>, the University of Georgia<\/a> in the US, and investment fund Putnam<\/a>. Also included are a number of US banks, and organisations in the Netherlands and Switzerland.<\/p>\n

A Shell spokesperson confirmed that the organisation had been affected by the incident. \u201cWe are aware of a cyber security incident that has impacted a third-party tool from Progress called MOVEit Transfer, which is used by a small number of Shell employees and customers,\u201d they said.<\/p>\n

\u201cThere is no evidence of impact to Shell\u2019s core IT systems. Our IT teams are investigating. We are not communicating with the hackers.\u201d<\/p>\n

Computer Weekly understands that unlike some other affected organisations, Shell was not affected via the systems of a third-party supplier or contractor.<\/p>\n

\n

<\/i>Many more names to come<\/h3>\n

Not appearing on Clop’s leak site \u2013 at the time of writing \u2013 are the names of several known MOVEit victims, including the BBC, Boots, British Airways<\/a>, Ofcom<\/a> and TfL.<\/p>\n

However, it is important to note that due to the high number of victims it has likely compromised \u2013 more than 2,000 instances of MOVEit Transfer were exposed to the public internet last week, and figure does not include compromised customers of the instance owners \u2013 Clop is likely staggering its release.<\/p>\n

As such, the non-appearance of some high-profile names at this early stage is no indication that the victims have engaged with Clop or paid a ransom, and no such indication should be inferred.<\/p>\n

Secureworks Counter Threat Unit<\/a> threat research director Chris Yule said it would likely take the cyber criminals some time to work through the victims.<\/p>\n

\u201cIt remains to be seen if there will be one dump or a drip feed, [but] the GoAnywhere victims were posted in batches over a period of 14 days,\u201d said Yule.<\/p>\n

\u201cThe first names Clop have posted included a number of US-based financial services companies. Whilst the upload has just begun, we anticipate that the balance of victims will likely be based in the US, as the majority of MOVEit servers on the internet were based there.\u201d<\/p>\n

H\u00fcseyin Can Yuceel, a threat researcher at Picus Security<\/a>, said that releasing the details of its victims more slowly could serve to pressure others into paying a ransom, and it was clear that Clop had not been bluffing in its threats.<\/p>\n<\/section>\n

\n

<\/i>What victims should do next<\/h3>\n

While no ransomware locker has been executed on any of the victim systems so far \u2013 this is consistent with Clop\u2019s modus operandi in such situations \u2013 the playbook for how to deal with a data exfiltration and extortion incident is broadly similar to a situation where data encryption has taken place.<\/p>\n

\u201cPrevention is always the number one priority against ransomware attacks. [Afterwards] there is not much that can be done,\u201d said Can Yuceel.<\/p>\n

\u201cEven if backups are in place, ransomware groups can release their victims’ sensitive data and harm their reputation. Law enforcement agencies advise businesses not to pay ransoms because ransomware groups may not deliver the decryption key after the payment. There are also other risks with ransom payments.<\/p>\n

\u201cWe have observed that organisations known to pay the ransom are much more likely to be targeted by the same or other ransomware groups in the future. Ransom payments can also perpetuate the ransomware threat and are used to fund other illegal activities.\u201d<\/p>\n

Can Yuceel warned that for the UK\u2019s growing roster of victims \u2013 which now also includes Adare SEC<\/a>, a specialist customer comms services supplier for the financial and insurance sector with customers including Legal & General, AON and Allianz<\/a> \u2013 should be particularly wary of engaging or paying a ransom due to strict financial regulations covering payments to Russian criminal organisations.<\/p>\n

\u201cThe Office of Financial Sanctions Implementation<\/a> considers ransom payments as a breach of financial sanctions, which is a serious criminal offence and can carry a custodial sentence and the imposition of a monetary penalty,\u201d he said.<\/p>\n

\u201cVictims in the UK should therefore report the attack to the National Cyber Security<\/a> Centre and request support for managing the cyber incident if needed.\u201d<\/p>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

As it had previously threatened, the Clop cyber crime cartel has started publicly naming victims allegedly compromised via a SQL injection flaw in Progress Software\u2019s MOVEit managed file transfer product, who have resisted its extortion attempt. Clop, which is believed to be based in Russia, told users of the MOVEit Transfer product last week that […]<\/p>\n","protected":false},"author":1,"featured_media":92881,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[533],"tags":[],"class_list":["post-92880","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it"],"_links":{"self":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/92880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=92880"}],"version-history":[{"count":0,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/92880\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/media\/92881"}],"wp:attachment":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=92880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=92880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=92880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}