A spokesperson for the cloud data management firm Rubrik, confirms that the company was compromised by malicious threat actors from the Clop ransomware group, exploiting a vulnerability in a third-party file transfer tool. The threat actors exploited a flaw in the GoAnywhere MFT managed file-transfer solution from Fortra, a critical vulnerability which has already led to the compromise of over 100 additional organizations. The flaw, tracked as CVE-2023-0669, is a pre-authentication command injection vulnerability from deserializing an arbitrary attacker-controlled object within GoAnywhere’s License Response Servlet. A malicious attacker who has gained access to an administrator console could exploit this flaw to conduct remote code execution (RCE). The exfiltrated Rubrik data comes from a non-production IT testing environment containing internal sales information such as customer and partner names, business contacts, and a “limited number” of distributor orders. The third-party firm conducting Rubrik’s post breach analysis stated that “there was no sensitive personal data such as Social Security numbers, financial account numbers, or payment card numbers exposed in the servers accessed.” The data is slowly being posted on Clop’s leak site, in an attempt to further extort ransom payment from Rubrik. The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to their Known Exploited Vulnerabilities (KEV) catalog, meaning that regulated agencies must quickly patch the flaw or be held accountable. This vulnerability has since been patched, and CTIX analysts urge any organizations using GoAnywhere MFT to upgrade to version 7.1.2 to prevent exploitation. Attacks from Clop ransomware have been on the rise since the end of January, adding exfiltrated data to their leak site from several other organizations.