Explained: How MOVEit Breach Shows Hackers' Interest in File Transfer Tools

Governments and companies globally are scrambling to deal with the consequences of a mass compromise made public on Thursday.

By Reuters | Updated: 17 June 2023 00:02 IST

Explained: How MOVEit Breach Shows Hackers' Interest in File Transfer Tools

MFT software is what you want to exchange data between systems

Highlights

FTA, GoAnywhere MFT, MOVEit Transfer are corporate file sharing programs
Typical digital extortionists still encrypt a company's network
An MFT program typically faces the open internet

Ransom-seeking hackers have increasingly turned a greedy eye toward the world of managed file transfer (MFT) software, plundering the sensitive data being exchanged between organizations and their partners in a bid to win big payouts.

Governments and companies globally are scrambling to deal with the consequences of a mass compromise made public on Thursday that was tied to Progress Software's MOVEit Transfer product. In 2021 Accellion's File Transfer Appliance was exploited by hackers and earlier this year Fortra's GoAnywhere MFT was compromised to steal data from more than 100 companies.

So what is MFT software? And why are hackers so keen to subvert it?

Corporate dropboxes

FTA, GoAnywhere MFT, and MOVEit Transfer are corporate versions of file sharing programs consumers use all the time, like Dropbox or WeTransfer. MFT software often promises the ability to automate the movement of data, transfer documents at scale and provide fine-grained control over who can access what.

Consumer programs might be fine for exchanging files between people but MFT software is what you want to exchange data between systems, said James Lewis, the managing director of UK-based Pro2col, which consults on such systems.

"Dropbox and WeTransfer don't provide the workflow automation that MFT software can," he said.

MFT programs can be tempting targets

Running an extortion operation against a well-defended corporation is reasonably difficult, said Recorded Future analyst Allan Liska. Hackers need to establish a foothold, navigate through their victim's network and exfiltrate data — all while remaining undetected.

By contrast, subverting an MFT program — which typically faces the open internet — was something more akin to knocking over a convenience store, he said.

"If you can get to one of these file transfer points, all the data is right there. Wham. Bam. You go in. You get out."

Hacker tactics are shifting

Scooping up data that way is becoming an increasingly important part of the way hackers operate.

Typical digital extortionists still encrypt a company's network and demands payment to unscramble it. They might also threaten to leak the data in an effort to increase the pressure. But some are now dropping the finicky business of encrypting the data in the first place.

Increasingly, "a lot of ransomware groups want to move away from encrypt-and-extort to just extort," Liska said.

Joe Slowik, a manager with the cybersecurity company Huntress, said the switch to pure extortion was "a potentially smart move."

"It avoids the disruptive element of these incidents that attract law enforcement attention," he said.

Apple unveiled its first mixed reality headset, the Apple Vision Pro, at its annual developer conference, along with new Mac models and upcoming software updates. We discuss all the most important announcements made by the company at WWDC 2023 on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.