John Hammond, a senior researcher at cybersecurity firm Huntress, received information from an anonymous individual on June 15 regarding a new zero-day vulnerability in the MOVEit file-transfer software.
This type of flaw, which lacks a fix or patch, leaves users susceptible to hacker attacks. Adding to the complexity, the anonymous researcher publicly shared intricate details about the flaw on Twitter, potentially enabling attackers to exploit the vulnerability before the software owner could respond.
Such actions deviate from the typical practices of cybersecurity researchers who generally inform organizations about vulnerabilities before making them public, aiming to prevent aiding malicious actors. The US Department of Homeland Security, for instance, grants organizations 45 days to address vulnerability reports before public disclosure.
The revelation further worsened the existing crisis surrounding MOVEit, as it had already fallen victim to an ongoing hacking campaign by the Clop criminal group, primarily composed of Russian-speaking individuals.
Exploiting a different zero-day vulnerability, the group successfully gained unauthorized access to files from numerous companies and organizations. Consequently, the researcher’s discovery only added to the challenges faced by Progress Software Corp., the company behind MOVEit software.
Companies and Organizations Affected by Clop-MOVEit Hack
CLICK HERE TO READ THE FULL STORY
