File transfer servers keep getting hit
Accellion, GoAnywhere, MOVEit and now Cleo. File transfer tools hold exactly what attackers want.
This month attackers are mass-exploiting Cleo’s file transfer products (Harmony, VLTrader and LexiCom), and the Cl0p gang has claimed it. Before Cleo it was MOVEit in 2023, GoAnywhere, and Accellion before that.
Why these tools? They face the internet by design, partners log in from everywhere, and they hold invoices, payroll and customer files. One bug, and a gang can empty hundreds of companies at once.
If you run one:
- Patch fast and follow the vendor’s advice, including any interim steps like disabling a feature.
- Hunt for signs the vendor lists. Patching after a break-in doesn’t remove the attacker.
- Don’t keep files forever. Delete transfers after a few days. A breach can’t leak what isn’t there.
- Put it behind allow-lists for partners with fixed IPs.
- Know who your vendors use. Many breaches came through a supplier’s transfer server, not the victim’s.
A file transfer server is a vault with a public door. Treat it like one.