Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims

Updates on Feb 7, 2023

Summary

A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.

Advisories3

• Summary of the Investigation Related to CVE-2023-0669Fortra
• NVD: CVE-2023-0669NVD
• CISA Known Exploited Vulnerabilities CatalogCISA · Feb 10, 2023