Act Now: Vulnerability in Progress Softwares MOVEit Transfer Software
Summary
To prevent exploitation of the vulnerability, organizations are urged to disable all HTTP and HTTPs traffic to their MOVEit environment, delete unauthorized files and user accounts, reset credentials, and apply a patch. After applying the patch, organizations should enabled HTTP and HTTPs traffic, ensure that no unauthorized accounts remain, and continue to monitor the network, endpoints and logs for indicators of compromise. Satnam Narang, senior staff research engineer at Tenable, says file transfer applications have become increasingly popular among ransomware groups since late 2020. “While we don’t know the specifics around the group behind the zero day attacks involving MOVEit, it underscores a worrisome trend of threat actors targeting file transfer solutions,” Narang says. “Organizations that use MOVEit software should assume compromise and engage in incident response to determine the potential impact, if any.” If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!
