Explained: How MOVEit Breach Shows Hackers’ Interest in File Transfer Tools

Ransom-seeking hackers have more and more turned a grasping eye towards the world of managed file switch (MFT) software program, plundering the delicate information being exchanged between organizations and their companions in a bid to win large payouts.

Governments and corporations globally are scrambling to cope with the implications of a mass compromise made public on Thursday that was tied to Progress Software program’s MOVEit Switch product. In 2021 Accellion’s File Switch Equipment was exploited by hackers and earlier this yr Fortra’s GoAnywhere MFT was compromised to steal information from greater than 100 corporations.

So what’s MFT software program? And why are hackers so eager to subvert it?

Company dropboxes

FTA, GoAnywhere MFT, and MOVEit Switch are company variations of file sharing applications shoppers use on a regular basis, like Dropbox or WeTransfer. MFT software program usually guarantees the flexibility to automate the motion of information, switch paperwork at scale and supply fine-grained management over who can entry what.

Client applications is likely to be high quality for exchanging recordsdata between folks however MFT software program is what you need to alternate information between methods, mentioned James Lewis, the managing director of UK-based Pro2col, which consults on such methods.

“Dropbox and WeTransfer do not present the workflow automation that MFT software program can,” he mentioned.

MFT applications could be tempting targets

Operating an extortion operation towards a well-defended company is fairly troublesome, mentioned Recorded Future analyst Allan Liska. Hackers want to ascertain a foothold, navigate by their sufferer’s community and exfiltrate information — all whereas remaining undetected.

Against this, subverting an MFT program — which usually faces the open internet — was one thing extra akin to knocking over a comfort retailer, he mentioned.

“If you may get to certainly one of these file switch factors, all the information is correct there. Wham. Bam. You go in. You get out.”

Hacker ways are shifting

Scooping up information that method is turning into an more and more vital a part of the best way hackers function.

Typical digital extortionists nonetheless encrypt an organization’s community and calls for fee to unscramble it. They may additionally threaten to leak the information in an effort to extend the stress. However some are actually dropping the finicky enterprise of encrypting the information within the first place.

More and more, “a variety of ransomware teams need to transfer away from encrypt-and-extort to simply extort,” Liska mentioned.

Joe Slowik, a supervisor with the cybersecurity firm Huntress, mentioned the change to pure extortion was “a doubtlessly good transfer.”

“It avoids the disruptive factor of those incidents that entice regulation enforcement consideration,” he mentioned.

© Thomson Reuters 2023