Screw These Political Hacks (GET IT?)
Please someone tell me why on EARTH we aren't talking about one of the LARGEST HACKS on mission critical and confidential information from US Govt agencies as well as Banks, Colleges, etc. This info is being posted on the dark web....
If you like the work I’m doing here or on twitter and other platforms, please consider becoming a subscriber. This goes a long way to helping me produce good content for you guys long term.
Just a quick summary / quick hits on the ongoing Cyberattack currently affecting several organizations and depts of the US. At the moment, not much is known other than the fact that several large federal and state level organizations have been hit. Some commercial and some governmental. Among these is the DHS and the Pentagon. Data was stolen from these organizations through the use of a backend exploit of the SQL vulnerability that is susceptible to remote injection. This vulnerability is known as (CVE-2023-34362) The vulnerability allows for the injection of a web shell (or a script that is deployed through the web to execute a function.)
Using this script which was called LEMURLOOT they were able to access unauthorized areas of the software known as MOVEIt (In use by the govt since 2002) and create administrator profiles to begin stealing information and data from the orgs utilizing it. Its unconfirmed what information they've stolen and where it will go but they're threatening to publish all of it on the dark web if they aren't given an unspecified ransom. Naturally I assume a lot of it will also be sold to foreign govts as well for more profit assuming the hit wasn’t commissioned and paid for up front already.
The founder of the company, Progress Software, which created this software that's widely used is Joseph Alsop and he has been a prominent donor to Democrat campaigns since Hillary Clinton's 2000 Senatorial run on through Biden's recent run. Possibly an inflencing factor in the purchase of the software by the US Govt. IYKYK. Either way, i'd say our Gerontocracy is not prepared to address or understand this threat and also if this isnt the publicized threat made by the Anonymous subsidiary in Russia as well as REVIL but assuming that this widespread hack was this simple, it doesn't bode well for other less fortified areas of our cyber infrastructure.