Ransom-seeking hackers have become increasingly greedy in the world of managed file transfer (MFT) software, looting sensitive data that is exchanged between organizations and their partners in a bid to earn big payouts.
Governments and businesses around the world are scrambling to deal with the fallout from a massive compromise made public Thursday that was tied to Progress Software’s MOVEit Transfer product. In 2021, Accellion’s file transfer device was exploited by hackers, and earlier this year, Fortra’s GoAnywhere MFT was compromised to steal data from more than 100 companies.
So what is MFT software? And why are hackers so interested in subverting it?
corporate dropboxes
FTA, GoAnywhere MFT, and MOVEit Transfer are corporate versions of file-sharing programs that consumers use all the time, like Dropbox or WeTransfer. MFT software often promises the ability to automate data movement, transfer documents at scale, and provide granular control over who can access what.
Consumer programs may be fine for exchanging files between people, but MFT software is what you need to exchange data between systems, said James Lewis, managing director of UK-based Pro2col, which advises on such systems.
“Dropbox and WeTransfer do not provide the workflow automation that the MFT software offers,” he said.
MFT programs can be tempting targets
Running an extortion operation against a well-defended corporation is reasonably difficult, said Allan Liska, an analyst at Recorded Future. Hackers need to establish a foothold, navigate through their victim’s network, and extract data, all without being detected.
By contrast, subverting an MFT program, which is usually pitted against the open internet, was something more akin to tearing down a convenience store, he said.
“If you can get to one of these file transfer points, all the data is there. Wham. Bam. In. Out.”
Hacker tactics are changing
Gathering data in that way is becoming an increasingly important part of the way hackers operate.
Typical digital extortionists still encrypt a company’s network and demand payment to decrypt it. They could also threaten to leak the data in an effort to increase the pressure. But some are now abandoning the finicky business of encrypting data in the first place.
Increasingly, “a lot of ransomware groups want to stop encrypting and extorting and just extorting,” Liska said.
Joe Slowik, a manager at cybersecurity firm Huntress, said the move to pure extortion was “a potentially smart move.”
“Avoid the disturbing element of these incidents that attract the attention of law enforcement,” he said.
© Thomson Reuters 2023
