Are you ready for MOVEit?

Multiple vulnerabilities have recently been identified in the managed file transfer (MFT) software MOVEit developed by Ipswitch, Inc. and produced by Progress Software. These include CVE-2023-34362 ^[1], CVE-2023-35036 ^[2] and CVE-2023-35708 ^[3]. These vulnerabilities allow adversaries to gain unauthorized access and escalate privileges in the environment.

MOVEit is a popular tool that is used by thousands of organizations around the world. These include organizations in the public, private, and government sectors. The transfer software can be deployed as on-prem, in the MOVEit Cloud, or on any Microsoft Azure server. Due to the nature of handling potentially sensitive information, MOVEit is a lucrative target from a threat actor’s perspective, granting threat actors the ability to add and remove database content, execute arbitrary code, and steal sensitive information.

While this story is still actively playing out and we will know the final count only in the coming weeks, here’s what we know about it thus far. 

The CL0p ransomware gang has been actively exploiting this vulnerability and has claimed to compromise over dozens of organizations across different industries and regions. These include oil & gas, news & media, healthcare, financial services, state and federal governments, and more. Anomali’s own assessment has shown that there are thousands of externally exposed MOVEit instances that could potentially be exploited. 

Additional public research has revealed that this vulnerability may have been actively exploited even since 2021 ^[4]. More recently, organizations have also released proof of concept (PoC) exploit code for this vulnerability ^[5], making it likely that other attackers could exploit unpatched systems.

Anomali MOVEit Vulnerability Dashboard

The Anomali Threat Research team has additionally researched and documented additional details on this vulnerability via Threat Bulletin. The team has also identified over 430 relevant  indicators and signatures and several sector specific articles to provide more industry-specific details. The dashboard below highlights some of the insights available to Anomali customers via ThreatStream.

There are several steps important to reduce the impact of this vulnerability, some of which are also documented in Progress’ knowledge base article ^[6]

1. Discover your attack surface. there are several tools that offer this capability, including Anomali Attack Surface Management ^[7]
2. Patch the vulnerable systems at the earliest. The Progress knowledge base ^[6] article captures this in the following steps
          a.Disable HTTP/S traffic to your MOVEit Transfer environment
          b.Patch the vulnerable systems
          c.Enable HTTP/S access to the MOVEit Transfer environment
3. Monitor your environment for any known indicators to identify malicious activities. The Anomali Threat Bulletin captures over 2200 observables that can be used to monitor for malicious activities via a SIEM, firewall, or other technologies. Proactively distribute these indicators to your security controls (firewalls, proxies, etc.) to monitor for any malicious activity.

Anomali MOVEit Vulnerability Threat Bulletin

4. Hunt for any attacker footprints. While monitoring looks forward, hunting allows you to look back in the past for any attacker activity. There are several tools that can help you hunt, including Anomali Match ^[8]. Match can help customers search years of data in seconds to understand if any attacker activity has occurred in the past.
5. Look beyond yourself. Monitor your industry activity for any malicious activities. Your threat intelligence platform, including Anomali ThreatStream ^[9], should be able to assist you in monitoring industry trends. Participate in ISACs to ensure you are sharing intelligence with industry peers to develop a collective defense posture.
6. Have a response plan. Test your response plan, have your communications plans in place, build & test your automated workflows for a timely response.

Anomali will continue to refine our blogs, bulletins and dashboards as we learn more about MOVEit. 

To learn more about this vulnerability, join our threat intelligence experts for a live webinar on June 21, 2023. Register here for attending live or to be notified when the on-demand webinar is available. 

References

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-34362 
[2] https://nvd.nist.gov/vuln/detail/CVE-2023-35036 
[3] https://nvd.nist.gov/vuln/detail/CVE-2023-35708
[4] https://www.bleepingcomputer.com/news/security/clop-ransomware-likely-testing-moveit-zero-day-since-2021/
[5] https://www.helpnetsecurity.com/2023/06/13/cve-2023-34362-exploit/
[6] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023
[7] https://www.anomali.com/products/attack-surface-management
[8] https://www.anomali.com/products/match
[9] https://www.anomali.com/products/threatstream