Loading story…
Cybersecurity agencies from the United States, United Kingdom, Australia, New Zealand, and Singapore warned that threat actors were actively exploiting multiple Accellion File Transfer Appliance (FTA) vulnerabilities to compromise organizations worldwide. The campaign abused CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, and CVE-2021-27104 to deploy a web shell, execute commands, steal data, and erase logs, affecting government and private-sector victims across medical, legal, telecommunications, finance, and energy sectors. Authorities said some intrusions led to data theft and extortion, identified suspicious outbound traffic to 194.88.104[.]24 and 45.135.229[.]179, and urged organizations to isolate affected systems, collect forensic images, reset credentials and tokens, upgrade to version 9_12_432 or later, and migrate away from the end-of-life platform.
One disclosed victim was Morgan Stanley, which said attackers breached the Accellion FTA server of third-party vendor Guidehouse and stole encrypted files tied to stock plan participants. The attackers also obtained the decryption key, exposing sensitive data including names, addresses, dates of birth, Social Security numbers, and corporate company names, while Morgan Stanley said its own internal applications were not compromised. Reporting linked the broader Accellion intrusion wave to FIN11 and the Clop ransomware operation, underscoring how exploitation of a legacy file-transfer appliance cascaded into downstream third-party data breaches and extortion risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Morgan Stanley reported that personal information of stock plan participants was exposed after attackers compromised Guidehouse's Accellion FTA server. The company said its own applications were not breached, but stolen data included names, addresses, dates of birth, Social Security numbers, and corporate company names.
Cybersecurity authorities from Australia, New Zealand, Singapore, the United Kingdom, and the United States jointly warned that threat actors were actively exploiting multiple Accellion FTA vulnerabilities. The advisory said the campaign affected government and private-sector organizations globally and in some cases led to data theft and extortion.
In May 2021, Guidehouse notified Morgan Stanley that attackers had stolen information belonging to Morgan Stanley stock plan participants. Guidehouse also determined the impact to Morgan Stanley customers that month.
Qualys disclosed that attackers accessed files on its Accellion FTA server used for customer support-related file transfers, and some customer data was later published on Cl0p’s leak site. The company said the affected server was isolated from its production environment and Qualys Cloud Platform, and that impacted customers were notified.
Guidehouse discovered the breach in March 2021 after its Accellion FTA server had been compromised. The incident was later determined to have exposed Morgan Stanley stock plan participant data.
In January 2021, attackers exploited an Accellion FTA vulnerability to breach Guidehouse, a third-party vendor supporting Morgan Stanley's StockPlan Connect business. They stole Morgan Stanley-related encrypted files and also obtained the decryption key.
Accellion released a patch for the zero-day vulnerability in its FTA product on December 23, 2020. Later reporting said Guidehouse patched its affected server within five days of the fix becoming available.
Accellion became aware of a zero-day vulnerability affecting its legacy File Transfer Appliance in mid-December 2020. This vulnerability was part of the broader intrusion wave later tied to multiple customer breaches.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceus-cert.cisa.gov
Open sourcecomputerweekly.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited vulnerabilities in the legacy **Accellion File Transfer Appliance (FTA)** and deployed a file-downloading web shell to steal data from organizations worldwide, triggering breaches at telecom, legal, financial, and other enterprises. Reporting tied the campaign to the **Clop** ransomware operation, with additional analysis suggesting overlap with **FIN11**, as victims including **Singtel** and a global law firm said their incidents stemmed from compromise at the file-sharing provider rather than direct intrusion into their own networks. The intrusions were followed by aggressive extortion, including public leak threats and, in at least one case, the exposure of bank employee personal data to pressure payment. Subsequent government warnings said cybersecurity agencies had observed active exploitation of Accellion vulnerabilities, reinforcing the incident as part of Clop’s broader pattern of targeting managed file transfer products to conduct large-scale data theft and shaming-based extortion rather than relying solely on encryption.
Jun 29, 2026
The **Clop** ransomware and data-extortion operation has been linked to the TA505 ecosystem and has targeted organizations since 2019 through a mix of spear-phishing, stolen or compromised `RDP` credentials, and exploitation of internet-facing applications. Reporting on the group describes a shift from conventional ransomware deployment toward large-scale data theft and extortion, with victims pressured through leak-site exposure after sensitive information was exfiltrated. Clop has been repeatedly tied to attacks on managed file transfer software, including **Accellion FTA**, **GoAnywhere MFT**, and **MOVEit Transfer**. In the MOVEit campaign, attackers exploited a `SQL injection` flaw, deployed the **LEMURLOOT** web shell, and stole data from backend databases; broader intrusion activity associated with the group has also included **PowerShell** execution, privilege escalation, process injection, **Cobalt Strike** command-and-control, persistence via web shells, and encryption for impact in some cases.
Aug 6, 2026
FBI and CISA warned that APT actors were actively scanning internet-facing Fortinet devices and exploiting multiple FortiOS vulnerabilities, including **`CVE-2018-13379`**, **`CVE-2020-12812`**, and **`CVE-2019-5591`**, to gain initial access and maintain a foothold for follow-on attacks. The agencies said the activity affected government, commercial, technology, and critical infrastructure organizations, with scanning observed on ports **4443**, **8443**, and **10443**. In one cited case, an APT group almost certainly exploited a FortiGate appliance to access a web server hosting a U.S. municipal government domain and likely created the username **`elie`** on the network. The campaign built on long-running exploitation of Fortinet SSL VPN weaknesses, especially the path traversal flaw **`CVE-2018-13379`**, which had already enabled the leak of credential-bearing session files from nearly **50,000** vulnerable devices worldwide. Those exposed **`sslvpn_websession`** files contained plaintext usernames and passwords, allowing attackers to reuse credentials even after patching. U.S. authorities said compromised access could support data exfiltration, ransomware-style encryption, and other post-exploitation activity, and highlighted indicators including FRP tunneling tools, unusual FTP traffic over port **443**, and a scheduled task named **`SynchronizeTimeZone`**.
Aug 15, 2026