Cybercriminals have exploited Accellion File Transfer Appliance (FTA) zero-day vulnerabilities to steal and extort data from various global organizations, according to FireEye. The news comes after Accellion earlier this month said it patched all known FTA vulnerabilities exploited by cybercriminals.
Several organizations have issued warnings following Accellion FTA breaches, including:
Malicious actors began to exploit zero-day vulnerabilities in Accellion FTA in mid-December, FireEye noted. They used the vulnerabilities to install the DEWMODE web shell.
In late January, organizations that had been impacted by Accellion FTA attacks the month prior began to receive extortion emails from malicious actors, FireEye stated. Malicious actors used these emails to threaten to publish stolen data from victims.
How Should Organizations Respond to Accellion FTA Cyberattacks?
Accellion is encouraging FTA customers to migrate to kiteworks for file sharing, CISO Frank Balonis said. It has accelerated its FTA end-of-life plans and continues to explore ways to assist customers affected by the cyberattacks.
In addition, Accellion has patched FTA vulnerabilities known to be exploited by threat actors, FireEye said. It also has added new monitoring and alerting capabilities to flag anomalies associated with these attack vectors.
FireEye is performing penetration testing and code review of the current version of the Accellion FTA product, the company indicated. To date, FireEye has not found any other critical vulnerabilities in the product.
