Ongoing Ransomware Campaign Actively Exploiting a Vulnerability in Fortra’s GoAnywhere

There is an ongoing ransomware campaign actively exploiting a vulnerability (CVE-2023-0669) in Fortra’s GoAnywhere Managed File Transfer (MFT), a system that allows companies to securely transfer huge sets of data and other large files.

Successful exploitation of the pre-authentication command injection vulnerability allows attackers to gain remote code execution on vulnerable GoAnywhere MFT instances whose administrative console is exposed to the Internet.

Possible indicators of compromise (IOCs) associated with the ongoing ransomware campaign are shown in the table below.

Users and administrators with Internet-exposed GoAnywhere MFT administration console are advised to download the security patch immediately.

Network administrators are also advised to scan their networks for the presence of IOCs and configure their firewall rules to block connections to domains associated with the campaign. Network administrators are recommended to limit open ports to necessary systems and consider changing the default ports (i.e. 8000 and 8001) of GoAnywhere Administrator that have been observed in vulnerable GoAnywhere MFT instances.

Users and administrators may refer to our advisory on how to protect their systems and data from ransomware threats at:
Protect Your Systems and Data from Ransomware Attacks [PDF, 253 KB]

If your organisation is a victim of a ransomware incident, please refer to our ransomware response checklist at:
Ransomware Response Checklist [PDF, 146 KB]

More information is available here:
https://therecord.media/clop-ransomware-adds-dozens-to-goanywhere-victim-list

https://www.huntress.com/blog/investigating-intrusions-from-intriguing-exploits