Hackers Exploit Accellion Zero-Days in Recent Data Theft and Extortion Attacks

Cybersecurity researchers on Monday tied a string of attacks concentrating on Accellion File Transfer Appliance (FTA) servers more than the past two months to facts theft and extortion marketing campaign orchestrated by a cybercrime group named UNC2546.

The assaults, which commenced in mid-December 2020, involved exploiting numerous zero-day vulnerabilities in the legacy FTA software to install a new internet shell named DEWMODE on victim networks and exfiltrating delicate data, which was then printed on a information leak website operated by the CLOP ransomware gang.

But in a twist, no ransomware was truly deployed in any of the current incidents that hit companies in the U.S., Singapore, Canada, and the Netherlands, with the actors in its place resorting to extortion e-mail to threaten victims into spending bitcoin ransoms.

password auditor

According to Dangerous Enterprise, some of the organizations that have had their info listed on the web page incorporate Singapore’s telecom service provider SingTel, the American Bureau of Delivery, legislation business Jones Day, the Netherlands-based mostly Fugro, and life sciences company Danaher.


Pursuing the slew of attacks, Accellion has patched 4 FTA vulnerabilities that ended up identified to be exploited by the threat actors, in addition to incorporating new checking and alerting abilities to flag any suspicious conduct. The flaws are as follows –

  • CVE-2021-27101 – SQL injection by using a crafted Host header
  • CVE-2021-27102 – OS command execution via a neighborhood world-wide-web assistance get in touch with
  • CVE-2021-27103 – SSRF by means of a crafted Publish ask for
  • CVE-2021-27104 – OS command execution by using a crafted Put up ask for

FireEye’s Mandiant danger intelligence team, which is primary the incident reaction attempts, is monitoring the comply with-on extortion plan less than a individual menace cluster it phone calls UNC2582 even with “persuasive” overlaps recognized involving the two sets of malicious actions and prior attacks carried out by a monetarily determined hacking team dubbed FIN11.

“Numerous of the organizations compromised by UNC2546 have been formerly qualified by FIN11,” FireEye mentioned. “Some UNC2582 extortion emails noticed in January 2021 were sent from IP addresses and/or e mail accounts applied by FIN11 in many phishing campaigns in between August and December 2020.”

The moment installed, the DEWMODE website shell was leveraged to obtain files from compromised FTA circumstances, primary to the victims obtaining extortion emails boasting to be from the “CLOP ransomware workforce” numerous months later on.

Lack of reply in a well timed way would result in extra emails sent to a broader group of recipients in the sufferer group as properly as its companions that contains backlinks to the stolen details, the scientists detailed.

Besides urging its FTA buyers to migrate to kiteworks, Accellion mentioned fewer than 100 out of 300 full FTA customers ended up victims of the attack and that fewer than 25 look to have endured “major” details theft.

The growth arrives soon after grocery chain Kroger disclosed very last 7 days that HR facts, pharmacy documents, and cash services data belonging to some customers could have been compromised as a outcome of the Accellion incident.

Fibo Quantum