![\"\"](\"https:\/\/dtasiagroup.com\/wp-content\/uploads\/2023\/05\/Blog-image-1920-\u00d7-1080-px-31-1024x576.png\")
<\/p>\n<\/p>\n
We\u2019d like to provide an update on our investigation into the suspicious activity detected in our Fortra GoAnywhere MFT solution. Working with Unit 42, we have completed our investigation and have compiled a factual summary of the investigation, as well as continuous improvement actions Fortra is taking to further strengthen our systems and recommended actions customers can take to secure their data and improve their security posture using available features in the GoAnywhere MFT solution.<\/p>\n
<\/p>\n
What happened:<\/strong><\/p>\n On January 30, 2023, we were made aware of suspicious activity within certain instances of our GoAnywhere MFTaaS solution. We quickly implemented a temporary service outage and commenced an investigation.<\/p>\n We discovered between January 28, 2023, and January 30, 2023, an unauthorized party used a previously unknown, zero-day remote code execution (RCE) vulnerability to access certain GoAnywhere customers\u2019 systems. This vulnerability was assigned CVE-2023-0669.<\/p>\n Our initial investigation revealed the unauthorized party used CVE-2023-0669 to create unauthorized user accounts in some MFTaaS customer environments. For a subset of these customers, the unauthorized party leveraged these user accounts to download files from their hosted MFTaaS environments. We prioritized communication with each of these customers to share as much relevant information as available to their specific instance of the GoAnywhere platform.<\/p>\n During the investigation, we discovered the unauthorized party used CVE-2023-0669 to install up to two additional tools – \u201cNetcat\u201d and \u201cErrors.jsp\u201d – in some MFTaaS customer environments between January 28, 2023 and January 31, 2023. The threat actor was not able to install both tools in every customer environment, and neither tool was consistently installed in every environment.<\/p>\n When we identified the tools used in the attack, we communicated directly with each customer if either of these tools were discovered in their environment. We reprovisioned a clean and secure MFTaaS environment and worked with each MFTaaS customer to implement mitigation measures. While we continue to monitor our hosted environment, there is no evidence of unauthorized access to customer environments that have been mitigated and reprovisioned by our team.<\/p>\n <\/p>\n On Premise Customers<\/strong><\/p>\n As the investigation unfolded, we were made aware the same CVE-2023-0669 was used against a small number of on-premise implementations running a specific configuration of the GoAnywhere MFT solution. Based on reports from customers, this activity pushed the unauthorized activity timeline to January 18.<\/p>\n We determined that customers running an admin portal exposed to the internet, which represents a small minority of customers, were at an increased risk and promptly communicated with those customers regarding mitigation of this risk. We urgently notified all on-premise customers that a patch was available and shared additional mitigation guidance. It is important to note that Fortra does not administer the infrastructure for on-premise instances, and we worked with customers to provide support and indicators of compromise.<\/p>\n At this time, we can confirm this issue was isolated to our GoAnywhere MFT solution and does not involve any other aspects of the Fortra business, or its customers.<\/p>\n <\/p>\n Next Steps<\/strong><\/p>\n As we move forward from this event, we will continuously review our operating practices and security program to ensure we emerge stronger as an organization. We are committed to continuous improvement as an organization on our current practices in areas such as:<\/p>\n For all customers, we recommend they follow the mitigation actions listed below, as well as employ industry specific configuration practices regarding data protection available in our customer center. For on-premise GoAnywhere customers, we recommend following our stated implementation guidelines including not allowing admin portal access from the internet.<\/p>\n GoAnywhere continues to include a number of security features that our customers may implement to help further safeguard data within their GoAnywhere MFT environment. Customers should download and follow the best practices defined in the manuals available in the customer portal: https:\/\/my.goanywhere.com\/<\/a> including the \u201cGoAnywhere MFT Hardening Guide.\u201d<\/p>\n\n