GoAnywhere is Fortra’s managed file transfer software, and a zero-day flaw in it, CVE-2023-0669, was used by the Cl0p ransomware group in early 2023. Hitachi Energy confirmed a data breach as part of these attacks. Cl0p said it had breached 130 organizations. The flaw was fixed in GoAnywhere MFT version 7.1.2.
What happened to Hitachi Energy in the GoAnywhere attacks?
Hitachi Energy has confirmed a data breach as part of the GoAnywhere attacks. The Cl0p ransomware gang behind the attacks exploited a 0-day vulnerability in Fortra GoAnywhere MFT (Managed File Transfer) to gain access. Hitachi Energy, part of the Japanese Hitachi group and headquartered in Zurich, Switzerland, provides energy solutions and power systems.
What is the GoAnywhere 0-day vulnerability?
Recently, it was discovered that a third-party software provider named FORTRA GoAnywhere MFT was vulnerable to a zero-day vulnerability and was being used in attacks by the Cl0p ransomware group targeting institutions/organizations in various countries. These attacks result in unauthorized access to the targeted institutions’ inventories and data.
Cl0p Ransomware Gangs Announced They Exploit Over 130 Organizations
The 0-day vulnerability in the GoAnywhere file-sharing software is tracked with the code CVE-2023-0669 and was first discovered on February 3, 2023. On February 6, 2023, an exploit code was released for this vulnerability, and by February 10, 2023, Cl0p operators had announced that they had used the exploit to attack 130 organizations. The following specific industries and sectors were targeted in these attacks:
- Community Health Systems (CHS)
- A cybersecurity firm
- Hitachi Energy, which provides services in the energy sector.
For more information about Cl0p and other ransomware groups, read our blog post.
Solution Proposal
- Regularly conducting attack surface analyses to protect inventories of institutions and organizations,
- Using up-to-date versions of all systems, programs, applications, and other inventories where vulnerabilities have been addressed.
Fortra GoAnywhere MFT was hit again: CISA later flagged CVE-2025-10035 in it for known ransomware campaign use. See Remote support and file transfer flaws in ransomware attacks.