Microsoft: Lace Tempest Hackers Behind Active Exploitation of MOVEit Transfer App

Jun 05, 2023Ravie LakshmananZero Day / Cyber Attack

Microsoft has officially linked the ongoing active exploitation of a critical flaw in the Progress Software MOVEit Transfer application to a threat actor it tracks as Lace Tempest.

“Exploitation is often followed by deployment of a web shell with data exfiltration capabilities,” the Microsoft Threat Intelligence team said in a series of tweets today. “CVE-2023-34362 allows attackers to authenticate as any user.”

Lace Tempest, also called Storm-0950, is a ransomware affiliate that overlaps with other groups such as FIN11, TA505, and Evil Corp. It’s also known to operate the Cl0p extortion site.


The threat actor also has a track record of exploiting different zero-day flaws to siphon data and extort victims, with the group recently observed weaponizing a severe bug in PaperCut servers.

CVE-2023-34362 relates to an SQL injection vulnerability in MOVEit Transfer that enables unauthenticated, remote attackers to gain access to the database and execute arbitrary code.

There are believed to be at least over 3,000 exposed hosts utilizing the MOVEit Transfer service, according to data from attack surface management company Censys.


🔐 Mastering API Security: Understanding Your True Attack Surface

Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar!

Join the Session

Google-owned Mandiant, which is tracking the activity under the moniker UNC4857 and has labeled the web shell LEMURLOOT, said it identified broad tactical connections with FIN11.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), last week, added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, recommending federal agencies to apply vendor-provided patches by June 23, 2023.

The development follows the similar zero-day mass exploitation of Accellion FTA servers in December 2020 and GoAnywhere MFT in January 2023, making it imperative that users apply the patches as soon as possible to secure against potential risks.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.
Cyber Security

Articles You May Like

Meta has Apple to thank for giving its annual VR conference added sizzle this year
Diwali With Mi 2023 Announced: Discounts on Redmi, Mi Phones, and More Products
Meta Smart Glasses in Collaboration With Ray-Ban Launched, Allows Hands-Free Livestreaming
Flexport fires CFO, HR chief departs weeks after sudden ouster of Dave Clark as CEO
Apple will issue a software update to address iPhone 15 overheating complaints

Leave a Reply

Your email address will not be published. Required fields are marked *