Week of May 29, 2023: MOVEit Transfer zero-day exploited, and Barracuda ESG attacks traced to 2022

What mattered to security leaders in the week of May 29, 2023? Progress Software warned on Wednesday, May 31 that a zero-day in its MOVEit Transfer file transfer product was being exploited to steal corporate data. Barracuda also disclosed that attacks on its Email Security Gateway appliances went back to October 2022.

MOVEit Transfer zero-day exploited to steal data

Progress told MOVEit Transfer customers that a vulnerability could lead to escalated privileges and unauthorized access, and asked them to check for signs of intrusion over at least the previous 30 days while it prepared a patch. By June 2 it had confirmed the flaw as a SQL injection bug in the web application that could give an unauthenticated attacker access to the database, affecting all versions, and published fixed releases and indicators of compromise. CISA added it to the KEV catalog as CVE-2023-34362 that day. (Help Net Security, Help Net Security, CISA)

Who was behind MOVEit? The pattern pointed to Clop

At the end of the week no group had claimed the MOVEit attacks and victims had not yet received extortion demands. BleepingComputer's Lawrence Abrams noted the campaign resembled earlier Clop operations that used zero-days in GoAnywhere MFT and Accellion FTA to steal files. The same roundup reported Trend Micro's finding that encryptors from the Royal operation and a new one called BlackSuit shared very strong similarities, feeding rumors of a rebrand. (BleepingComputer)

Barracuda ESG appliances were exploited from October 2022

Barracuda said the compromise of some customers' Email Security Gateway appliances through CVE-2023-2868, a remote command injection flaw it had acknowledged on May 23, led to three types of malware being deployed and data being exfiltrated. The earliest evidence of exploitation it had found dated to October 2022. A patch was applied to all ESG appliances worldwide on May 20, followed by a containment script. The company did not say how many organizations were breached. (Help Net Security)

MCNA Dental notifies almost 9 million patients

Managed Care of North America Dental, a large US provider of Medicaid and CHIP dental coverage, notified almost nine million people that their data was taken in a ransomware attack. MCNA said it spotted the unauthorized access on March 6, 2023, and that the attackers had first entered its network on February 26. Exposed fields included Social Security, driver's license and Medicaid-Medicare ID numbers. (BleepingComputer)

Harvard Pilgrim puts its ransomware toll at 2,550,922 people

Harvard Pilgrim Health Care reported to the US Department of Health and Human Services that an April 2023 ransomware attack affected 2,550,922 people, roughly all of its members. The nonprofit said the attackers had access to its systems from March 28 until the breach was discovered on April 17, 2023, and copied data during that window. Two healthcare disclosures in one week made the dwell-time question hard to ignore. (BleepingComputer)

Zyxel firewall command injection flaw added to KEV

On May 31 CISA added CVE-2023-28771, an OS command injection vulnerability affecting multiple Zyxel firewalls, to the Known Exploited Vulnerabilities catalog on evidence of active exploitation. Branch-office firewalls from smaller vendors are often managed by outside providers, so this was one to confirm with them directly. (CISA)