No 'Systemic Risk' to Government Networks From Latest Breach, CISA Says

UPDATED: 5:30 p.m. June 15

A cyberattack that exploited a major vulnerability found in a popular software product has impacted multiple federal agencies, according to the Cybersecurity and Infrastructure Security Agency, sparking concerns about the security of critical systems. 

Eric Goldstein, CISA’s executive assistant director for cybersecurity, confirmed in a statement sent to Nextgov/FCW that the cyber defense agency was "providing support to several federal agencies that have experienced intrusions affecting their MOVEit applications.” 

“We are working urgently to understand impacts and ensure timely remediation,” Goldstein said.

News of the cyberattack exploiting the MOVEit vulnerability was first reported by CNN on Thursday. CISA and the FBI issued a joint cybersecurity advisory last week warning that hackers were capable of exploiting a vulnerability to steal data from underlying MOVEit databases developed by Progress Software. 

CISA Director Jen Easterly said during a call with reporters on Thursday afternoon that the agency is "not tracking a significant impact against the civilian .gov enterprise," and that the attackers were not threatening to extort or release any data stolen from government agencies. 

"Although we are very concerned about this campaign and working on it with urgency, this is not a campaign like SolarWinds, that presents a systemic risk to our national security or our nation's networks," Easterly said. 

A senior CISA official on the press call said the attack only impacted a small number of federal agencies, though they declined to provide more specifics or directly attribute the intrusions on federal networks to the Russian-linked ransomware group. The official said that CISA had not identified any impact on military or IC networks, and was not aware of any federal agencies still running unmitigated versions of the MOVEit application.

Federal contracting records indicate that Progress Software products are in use across a variety of federal agencies, the military and the Intelligence Community, including the State Department, the Army and the Centers for Disease Control. 

Progress Software filed a disclosure report about the exploit with the Securities and Exchange Commission on May 30 indicating the company first got word of the zero day vulnerability on May 28. The company stated that it was using cybersecurity experts to "assess the extent and scope of the vulnerability" and that it had also "engaged with federal law enforcement and other federal agencies with respect to the vulnerability."

The company also released documentation about the risk of the exploit for customers on May 31. The firm also indicated that it had shut down components of its cloud service product temporarily in order to patch its services.  CISA released its security advisory for MOVEit customers the following day.

Nick Marinos, managing director of the Government Accountability Office Information Technology and Cybersecurity team, urged impacted agencies to "quickly and thoroughly execute incident response plans" in coordination with CISA and other federal entities that have governmentwide cybersecurity responsibilities. 

"Responding to cyber incidents is an all-hands effort," Marinos said in a statement to Nextgov/FCW. "So the more coordination and information sharing federal agencies can do with each other, the better."

While it remains unclear who was behind the cyberattack impacting federal agencies, CISA's advisory said that one of the largest phishing and ransomware groups worldwide had begun exploiting the MOVEit vulnerability. 

The Russian-linked ransomware gang called CL0P, or TA505, has previously leveraged similar exploits to conduct campaigns that targeted popular file transfer and software databases earlier this year. 

Ilkka Turunen, field chief technology officer for software firm Sonatype, compared the latest cyberattack to the Log4Shell software flaw and resulting fallout, saying the issue "will likely have a long tail impact in the future." 

"Precedent shows that vulnerabilities getting patched take a long time, so this will be with us for years," he added.