Cl0P Gang Sat on Exploit for MOVEit Flaw for Nearly 2 Years

Turns out the Cl0p ransomware group sat on a zero-day vulnerability it discovered in Progress Software’s MOVEit Transfer file transfer app for nearly two years before starting to exploit it — which it did with devastating effect earlier this month.

Over that holding period, members of the group periodically launched waves of malicious activity against vulnerable systems to test their access to organizations and to identity the ones to target.

“The analogy I have been using is turning the doorknob, seeing it turn, then walking away knowing I can come back later, open the door, and walk through it,” says Scott Downie, associate managing director at Kroll’s Cyber Risk Business. “It can also be interpreted as them identifying potential targets,” he says.

Experimenting With a MOVEit Exploit for Nearly 2 Years

Researchers at Kroll Threat Intelligence, who investigated the recent attacks, found evidence showing Cl0P actors experimenting with ways to exploit the MOVEit Transfer vulnerability as far back as July 2021. Kroll’s review of Microsoft Internet Information Services (IIS) logs belonging to clients impacted in the attacks unearthed evidence of the threat actors conducting similar activity in April 2022 and twice last month, just days before the attacks.

The telemetry suggests the threat actors were testing access to vulnerable MOVEit Transfer clients and attempting to retrieve information that could help them identity the organizations where it was installed. Much of the malicious reconnaissance and testing activity in the early stages — in July 2021 — appears to have been manual in nature. But starting April 2022, Cl0p actors began using an automated mechanism for probing multiple organizations at the same time and collecting information from them. 

The last of the testing activity — before mass exploitation began — was in May and appeared designed to extract the unique “Org ID” identifier associated with each MOVEit Transfer user. The information could have helped the attackers categorize the organizations they could access, Kroll said. The company’s analysis of the IP addresses associated with the malicious activity showed them to be located in Russia and the…