CISA warns of ongoing Accellion File Transfer Appliance attacks
Attacks have hit federal, state, and local governments


The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory warning of ongoing attacks targeting organizations using the Accellion File Transfer Appliance (FTA).
The advisory was issued jointly with the cyber security authorities of Australia, New Zealand, Singapore, the US, and the UK.
The statement said hackers have been exploiting the vulnerabilities to attack multiple federal and state, local, tribal, and territorial (SLTT) government organizations and private organizations, including those in the medical, legal, telecommunications, finance, and energy sectors.
Hackers publish Bombardier data in wide-reaching FTA cyber attack Npower shuts down app after hackers steal user data Hackers are using Google Alerts to help spread malware Secure your Wi-Fi against hackers in 10 steps
Attacks were also observed in organizations around the world, “including those in Australia, New Zealand, Singapore, the United Kingdom, and the United States”, according to CISA.
The attacks involve using vulnerabilities to target organizations using Accellion FTA. CISA said an attack on a governmental organization potentially included the breach of confidential organizational data in one incident.
“In some instances observed, the attacker has subsequently extorted money from victim organizations to prevent public release of information exfiltrated from the Accellion appliance,” CISA said.
According to the advisory, organizations should temporarily isolate or block internet access to and from systems hosting the software. Organizations should also assess systems for evidence of malicious activity, including the IOCs, and obtain a snapshot or forensic disk image of the system for subsequent investigation.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
“If malicious activity is identified, obtain a snapshot or forensic disk image of the system for subsequent investigation, then consider conducting an audit of Accellion FTA user accounts for any unauthorized changes, and consider resetting user passwords,” CISA advised.
Organizations were also urged to reset any security tokens on the system, including the “W1” encryption token, which may have been exposed through SQL injection.
“If an Accellion FTA appears compromised, organizations can get an indication of the exfiltrated files by obtaining a list of file-last-accessed events for the target files of the symlinks located in the /home/seos/apps/1000/ folder over the period of malicious activity,” the agency advised.
According to an Accellion statement earlier this week, out of approximately 300 FTA clients, fewer than 100 were victims of the attack. “Within this group, fewer than 25 appear to have suffered significant data theft,” the firm said.
Accellion said it’s now patched all known FTA vulnerabilities exploited by the threat actors and “has added new monitoring and alerting capabilities to flag anomalies associated with these attack vectors.”
“Accellion continues to offer support to all affected FTA customers to mitigate the impact of the attack,” it added.
Rene Millman is a freelance writer and broadcaster who covers cybersecurity, AI, IoT, and the cloud. He also works as a contributing analyst at GigaOm and has previously worked as an analyst for Gartner covering the infrastructure market. He has made numerous television appearances to give his views and expertise on technology trends and companies that affect and shape our lives. You can follow Rene Millman on Twitter.
-
LaunchDarkly to "double down" on observability with Highlight acquisition
News Highlight's observability tools will be integrated into LaunchDarkly's Guarded Releases software deployment service
By Daniel Todd
-
Samsung Galaxy Tab S10 FE review
Reviews The Tab S10 FE retains the feel and core capabilities of Samsung's high-end S10 tablets, but compromises on the display and the performance
By Stuart Andrews
-
China-backed hackers compromised six US government networks
News Mandiant researchers investigated APT41 activities between May 2021 and February 2022
By Zach Marzouk
-
DoJ fines former intel operatives who provided hacker-for-hire services to UAE
News A deal will see the charges suspended and the three defendants pay more than $1.6 million in penalties
By Rene Millman
-
Dual citizen sentenced to 11 years for role in North Korean crypto hacking scheme
News Ontario resident laundered cash for North Korea from bank heists and BEC scams
By Rene Millman
-
State Department reportedly suffers a cyber attack
News Details of the hack are still developing
By Rene Millman
-
Proposed "hack-back" bill could allow companies to retaliate against hackers
News The bipartisan bill would direct Homeland Security to look at the risks and benefits of private sector countermeasures
By Rene Millman
-
FBI shuts down web shells in hacked Exchange servers
News Court approves FBI operation to remove web shells from vulnerable Exchange servers
By Rene Millman
-
Tax refund scammers target university staff and students
News Like every year, tax refund scammers are in full force
By Rene Millman
-
Russian spy agencies warn of US cyber retaliation
News Moscow denies involvement in the SolarWinds attack but still fears US payback
By Rene Millman