Cyber ThreatIntelligence
ReportMARCH 2023

Contents
Introduction																 3Ransomware Tracking			 												 4Analyst comments			 													 5Sectors		

Threat Actors													 6														 7Regions																														 8Threat Spotlight Cl0p																						 9 - 11
Securing Your Systems - How do I Protect Myself?					 12

Introduction
Welcome to NCC Group’s monthly Cyber Threat Intelligence Report, bringing you exclusive insight into the latest Threat Intelligence, updates on recent and emerging advances inthe threat landscape and a deep understanding of the latest Tactics, Techniques and Procedures (TTPs) of threat actors.
Let us keep watch over the cyber and geopolitical landscape so you don’t have to.
Take a look at our cyber threat intelligence webpage to view all our previous reports and subscribe to our monthly highlights webinar.

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

3

Ransomware Tracking
We are continuing to track ransomware groups operating the hack and leak double extortion tactic,
this is achieved by actively monitoring the leak sites used by each ransomware group and scraping
victim details as they are released.
By recording this data and classifying the victims by sector, we are able to derive additional
insights such as, which sectors are being targeted this month, and how do these insights compare
to previous months?

MARCH ATTACKS

459
MONTH ON MONTH+91%
MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

4Analyst Comments
In our previous Threat Pulse, NCC Group touched upon the fact that we hadseen the highest number of ransomware hack & leak cases for both January andFebruary in the past 3 years, and this observation has continued into March. Infact, March’s ransomware victim numbers are the highest of any month in the past
three years, highlighting an enormous surge as visualised in Figure 1. February
to March 2023 exhibited a 91% increase from 240 attacks to 459; this also
illustrates a 62% increase, year-on-year, when compared to March 2022.
NCC Group have assessed that the cause of this dramatic incline is likely
associated with the highly publicised GoAnywhere MFT vulnerability being
exploited across the threat landscape. CL0P, who were the most active threat
actor in March, are known to have widely exploited this vulnerability, resulting in ahuge soar in their victim numbers. CL0Ps’ recent surge in activity and their modus
operandi will be discussed in depth in the Threat Spotlight of this report.

Figure 1 - Global Ransomware Attacks by Month

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

5

Sectors

Industrials
The most targeted sector in March 2023 was Industrials with a significant 147 attacks
out of 459, accounting for 32% of the total. In terms of total figures, this is an increaseof 67 attacks (84% increase) but a miniscule proportional decrease of 1%, showingthat irrespective of the dramatic increase of victims this month, the relative targeting
remains largely similar. This will likely continue to be the case for the majority of 2023 forthe same reasons that we have mentioned previously; Industrials contains possibly thewidest variety of industries that provide threat actors with opportunities to extort PII/IP,
and cause operational disruption to incentivise ransom payments.

Figure 2 - Top 10 targeted sectors March 2023

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT6Threat Actors
Cl0p's successful exploitation of the GoAnywhere vulnerability saw the threat group rise
to first place on the leader board, a position they have never held. This shift saw Lockbit
displaced to second most prominent threat actor, a decline we have not observed
since Lockbit was surpassed by the Royal and Cuba ransomware strains in November
2022. Given Lockbit’s persistent success as a highly relentless ransomware group,
supported by an affiliate model that affords them global reach, Clop’s position could beconsidered a rather insurmountable feat. That said, we suspect that their rise in attacks
will see results manifest only in the short-term, as organisations adopt patches against
GoAnywhere and Lockbit 3.0 reclaims their place. The group’s success nonethelessprovides a critical reminder of threat actor exploitation of zero-day vulnerabilities at pace,
their associated risks, and the importance of patching ASAP.

Figure 3 - Top 10 Threat Actors March 2023

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

7

Regions
Alongside the overall rise in cases in March, the weighting of targeting within each region
has remained mostly consistent with some minor differences. North America was themost targeted region with 221 cases out of the total 459 (48%), this was followed byEurope with 126 (28%), and Asia with 59 (13%). The remaining regions have remained
mostly consistent with their positions in February with just slight 1% decreases inproportional targeting across the board. Note that one of these incidents falls under “TADispute” which has been mentioned in the Threat Actors section just prior.
In terms of total figures, cases in North America have increased by 108 (96%) fromFebruary to March 2023, which is a proportional increase of just 1%, again highlightingthe targeting consistency. Europe’s total figures have increased by 70 cases (125%),
which is a more noticeable proportional increase of 5%, perhaps implying an increased
focus on European countries in March. Finally, Asia’s attack numbers have increased
by 24 cases (69%) which is a proportional decrease of 2%. Therefore, NCC Group as
always suggest that organisations residing all regions monitor and strengthen their cyberdefences where possible, but this is particularly pertinent for North America and Europe.

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

Figure 12 - Regional Analysis March 2023

8

Threat Spotlight: Cl0p
Who are CL0P?
Cl0p is a Ransomware-as-a-Service (RaaS) provider, ransomware threat group,
and a malware family as well – likely evolved from the CryptoMix ransomware family.
Discovered only in February 2019, the Russian-speaking group has not been on thecybercrime scene for as long as other more established actors, and yet has managed
to significantly evolve their sophistication and capability levels, as well as capture theattention of those within the security industry and mainstream media alike.

What is GoAnywhere?
The GoAnywhere Managed File Transfer (MFT) system is one used by over 3,000
organisations, mostly within the United States. The majority of organisations utilising
this package have more than 1,000 employees, with many having more than 10,000.
Companies of this size are often targeted as part of big game hunting campaigns, andthis is no exception; most of the known victims had revenues of over $1B and weresituated in sectors like government departments, healthcare, energy, tech, and thefinancial sector.

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

To conduct this campaign, Cl0p exploited CVE-2023-0669 to execute a cross-site
request forgery (CSRF). Instead of the typical practice of downloading a license filefrom a server and uploading it to a device, Fortra made the process more transparent
by delivering the license to a user through the administrator’s browser. However, thisgives the user a smoother experience; there is no protection against CSRF attempts.
Additionally, no authentication is required to exploit this issue, as no cookies are required
to undertake the license transfer. GoAnywhere MFT servers often sit on a network
perimeter, with the file transfer ports publicly exposed. This makes them increasingly
attractive targets to malicious actors, as they can be exploited to steal sensitive data
directly from the target, as well as pivoting to an organisation’s internal network.
Currently, some of the victims identified from the campaign include: the City of Toronto,
Virgin Red, UK Pension Protection Fund, Procter & Gamble, Saks Fifth Avenue, Hitachi
Energy, and Rio Tinto. A timeline of the attacks is illustrated below:
February 1st• 		 GoAnywhere send an advisory to users of their productFebruary 2nd• 		 Brian Krebs registers to GoAnywhere in order to gain authentication to view 								 advisory, publishes it on his Mastodon account9February 3rd• 		 Story picked up by cyber news outlets and vendors• 		 Fortra advises the Web Client interface is not exploitable• 		 Fortra advisory for customers to review admin users and monitor for suspicious 						 ones						 • Especially if users are created by system indicating follow-on attacker 											behaviour
February 6th• 		 Proof of exploit releasedFebruary 7th• 		 CVE-2023-0669 assigned• 		 Shodan shows 1K+ GoAnywhere instances exposed online, but only 135 on ports 				 8000 and 8001 used by the vulnerable admin console
February 10th
•		 Cl0p contacted BleepingComputer stating they’d stolen data from 130+ 										 organisations over a ten-day period					• They claimed they had the ability to move laterally within victim networks yet 							 decided not to deploy ransomware, instead limiting themselves to stealing data					 directly from MFT servers					• They did not provide any proof of these claims
March 10th
•		 Cl0p add 7 new companies to their leak site• 		 Patch 7.1.2 released					• Allegedly some of these victims have received ransom demands; contra to 									 what Cl0p stated in their communiques with BleepingComputer

February 9th

March 29th

•		 Fortra announces some MFTaaS instances were also compromised•		 Shodan indicates 94 instances on port 8000 and 8001 are still open							 • “We have determined that an unauthorized party accessed the systems 										 via a previously unknown exploit and created unauthorized user account.”

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT10Importantly, this is not the first time Cl0p has mass-hacked a vast number of largeorganisations by exploiting a vulnerability in a third-party product. The Accellion attacks
outlined above, occurring in late 2020 and early 2021, are a great example of this.
Using similar tactics to attack Accellion’s legacy File Transfer Appliance (FTA) with acombination of new web shells and zero-day vulnerabilities to exploit, they managed
to amass more than 100 victims. This time, it was Fortra’s GoAnywhere MFT tool andCVE-2023-0669, which were exploited. The targeting of multiple organisations and theannouncement of multiple victims in quick succession is something of an identifier for
Cl0p, which distinguishes them from other ransomware operators.
Notably, as Cl0p is a RaaS provider, a number of affiliates also exploit the ransomware
strain in their attacks. Cl0p have been linked to other actors before, most notably
TA505 and FIN11, and this recent campaign against the GoAnywhere MFT has been
attributed to actors other than Cl0p themselves. Additionally, Huntress linked the use of
the malware family Truebot which has been previously associated with another Russianspeaking threat group, Silence. Silence have also been linked in the past with TA505,
who are also being discussed as responsible for this latest spate of attacks.

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

11

Securing Your Systems: How do I Protect Myself?
Some simple mitigations organisations can adopt to prevent against this threat include:• Limit exposure on ports 8000 and 8001; these are the ports where the GoAnywhere
MFT admin panel is situated.
• Login to your account and follow the steps outlined in the GoAnywhere security
advisory.
• Install patch 7.1.2• Review admin user accounts for suspicious activity, with a special focus on accounts
created by system, suspicious or atypical timing of account creation, or disabled superusers creating multiple accounts.
• Contact GoAnywhere MFT support directly via portal, email, or phone to receive
additional assistance.

• Patch! Patch! Patch: New vulnerabilities are exposed regularly and it can be difficult
to keep up. However, a years-old vulnerability on a system which has not been patchedserves only to make an attacker’s life easier.
• Block common forms of entry: Create a plan for how to quickly disable at-risk systems
like VPNs or RDP, or look into endpoint security packages to detect exploits and malware
before they are utilised by attackers.
• Create backups: backup’s stored offline and offsite are beyond the reach of attackers
and can serve to get an organisation back on its feet with minimal downtime in the eventof falling victim to a ransomware attack.
Do not get attacked twice: Attackers can target organisations more than once. If they seethat a vulnerability remains unpatched, or that a security flaw which previously assisted
their attacks has not yet been remedied, they may return to the same victim for follow-up
attacks. Once the outbreak is isolated and the first attack is successfully stopped, every
trace of their intrusion, malware, tools, methods of entry, must be removed, assessed,
and acted upon to avoid being attacked again.

Further advice on mitigating ransomware specifically, as well as new emerging threats
more generally includes:• Know your estate: knowing what systems are in use and how they are configured
makes the task of knowing whether a recently announced vulnerability has the ability toimpact your organisation or not.

MARCH 2023 | CYBER THREAT INTELLIGENCE REPORT

12

Our experts are here to help you every step ofthe way. Contact us today to learn more aboutcyber security.
Copyright © 2023 NCC Group All rights reserved. No part of thisdocument shall be reproduced, stored in a retrieval system or transmitted
by any means without written permission from NCC Group.