The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have jointly issued an advisory regarding the ongoing exploitation of a recently revealed critical vulnerability in Progress Software's MOVEit Transfer application, resulting in ransomware attacks.
According to the agencies, the Cl0p Ransomware Gang, also known as TA505, has been actively taking advantage of a previously undisclosed SQL injection vulnerability found in Progress Software's managed file transfer (MFT) solution, which is known as MOVEit Transfer.
These attacks have targeted internet-facing MOVEit Transfer web applications, infecting them with a web shell known as LEMURLOOT. This web shell has been used as an entry point to pilfer data from the underlying MOVEit Transfer databases.
The cybercriminal group behind these attacks has issued an ultimatum to several affected businesses, warning them to make contact by June 14, 2023, or risk having all the stolen data made public.
Microsoft is closely monitoring this malicious activity under the codename Lace Tempest (also known as Storm-0950). This same group has also been linked to the exploitation of a critical security vulnerability in PaperCut servers.
Having been active since at least February 2019, this adversary is involved in various activities within the cybercrime ecosystem. This includes running a ransomware-as-a-service (RaaS) operation and serving as an affiliate for other RaaS schemes.