CVE-2023-0669

CVE-2023-0669 is a serious software vulnerability that was identified in Fortra's GoAnywhere Managed File Transfer (MFT) secure file transfer tool. This flaw, which allowed for remote code execution, was exploited by the Clop ransomware group as a zero-day vulnerability. The group launched a major campaign exploiting this vulnerability in late January 2023, affecting approximately 130 organizations over the course of 10 days. Notably, sensitive data from these organizations, including Procter & Gamble, Hitachi Energy, the city of Toronto, Community Health Systems, and Hatch Bank, were compromised. The Clop ransomware group continued to exploit this vulnerability throughout February 2023, claiming to have stolen sensitive data from over 130 organizations. They managed to compromise data from around 100 victim organizations after exploiting the remote code execution flaw in the Fortra MFT product. The systems targeted by the group often contained sensitive information, making them an attractive target for cybercriminals. This vulnerability was one among many others that the Clop ransomware group has been exploiting in its attacks. Other vulnerabilities include the Log4Shell flaw in Apache's Log4j software, a maximum severity bug in Apache ActiveMQ server technology, and a widely exploited remote code execution flaw in Progress Software's MOVEit file transfer technology. However, the attack on the GoAnywhere MFT flaw from 2023 was one of the most visible manifestations of the group's activities.