Clop Keeps Racking Up Ransomware Victims With GoAnywhere Flaw

After several weeks and more than 130 ransomware victims, GoAnywhere parent company Forta issues a statement.

A vulnerability in a commonly used file transfer service called GoAnywhere has allowed the Clop ransomware group to breach about 130 organizations. Weeks later, details are still emerging about the sprawling attack.
Up until now, those details werent coming from GoAnywhere parent company Fortra. Its been the victim organization making headlines with public data breach disclosures. GoAnywhere customers which have disclosed that they were breached through the GoAnywhere MFT remote code execution vulnerability, tracked under CVE-2023-0669, so far include
Community Health Systems
,
Hatch Bank
, cybersecurity company
Rubrik,

Hitachi Energy
, and the City of Toronto, which, when totaled up, represent the exposure of millions of peoples private data to the worst cybercriminal elements.
Clop cybercriminals were eager to provide details of their campaign, claiming on their leak site they used the exploit over the course of 10 days to
breach more than 130 companies
, according to
reports
.
For its part, Forta has remained publicly quiet about the steady stream of disclosures. But today, it gave Dark Reading a statement with reassurances that its committed to helping its customers navigate what is evolving into a communications, as well as a cybersecurity, crisis for the company.
On January 30, 2023, we were made aware of suspicious activity within certain instances of our GoAnywhere MFTaaS solution, Fortra says in a statement issued to Dark Reading. We immediately took multiple steps to address this, including implementing a temporary outage of this service to prevent any further unauthorized activity, and sharing mitigation guidance, which includes instructions to our on-prem customers about applying a developed patch.
Fortra added that it remains committed to supporting its affected users.
We are working diligently to notify customers who may have been impacted and we coordinated with CISA to add information about this vulnerability to their CVE catalog to broaden the reach of information about this issue, Fortras spokespersons statement adds. We are taking this very seriously and continue to help our customers implement mitigation steps to address this issue.
First reports of the
GoAnywhere zero-day
were shared on Feb. 2 by cybersecurity news site KrebsOnSecurity, which, after finding the advisory stuffed behind a login page, simply pasted the information for the public to see. Days later a
patch was issued
by Fortra. Betting on patch lagging, in the ensuing days, the Clop ransomware threat actors were able to take advantage. On Feb. 10, the Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its list of
known exploited vulnerabilities catalog
.
Nonetheless, companies have continued to get caught up in the ongoing campaign. And despite Fortras assurances, cybersecurity analysts, experts, and watchers are widely critical of the companys lack of communication and slow response in offering guidance to victims and targets. The attack surface is broad, too, it should be noted: According to its website, GoAnywhere is used at more than 3,000 organizations to manage documents of all kinds. And according to
data from Enlyft
, most of those are large organizations — with at least 1,000 and often more than 10,000 employees — mostly based in the United States.
This one wasnt communicated well, challenging even the best security teams to respond, Heath Renfrow, co-founder of Fenix24 tells Dark Reading in response to the freshly issued statement from Fortra. This is a good example of how it is necessary for security professionals to have multiple sources of threat intelligence — beyond just their providers — to cover every base. That said, it has been communicated now and anyone using the solution should patch immediately.
Slow communication can be especially detrimental in a software supply chain attack scenario, Dirk Schrader, vice president of security research at Netwrix said.
To prevent further evolvement of a supply chain attack, it is crucial for the first victim in line to communicate openly and in detail about what happened, he noted via email. It helps other links in this chain to be prepared for an upcoming threat and minimizes possible damage. It is likely that the current attack was accelerated due to details about this zero-day not being disclosed in a timely manner.
Dark Reading asked Fortra for a response to the criticism of its handling of the cybersecurity incident but has not received a response. Meanwhile, Fortas customer, the City of Toronto, when asked about its communications with Fortra regarding the breach, gave a simple response by email: Fortra has been communicating with the City and continues to do so.
This isnt the first time users of Clop ransomware have pulled off a mass breach like this. Russian-based FIN11 used
Clop ransomware
in December 2020 to jump on a similar Accellion zero-day flaw.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Clop Keeps Racking Up Ransomware Victims With GoAnywhere Flaw