Cyber Incident Victim: Iron Bow Technologies

On or around May 29, 2023, the cybercriminal group Clop initiated a widespread attack campaign exploiting a zero-day vulnerability in Progress Software’s MOVEit Secure File Transfer application, tracked as CVE-2023-34362. This vulnerability enabled unauthorized access and escalation of administrative privileges. As part of this campaign, Clop claimed numerous organizations as victims, including Iron Bow Technologies, a major IT solution provider. The group posted Iron Bow’s name on its dark web site, a platform it used to demand extortion payments from alleged victims in exchange for not publicly releasing stolen data.

In response to being named by Clop, Iron Bow Technologies initiated a detailed forensic investigation to determine the validity of the claims and the potential impact on its systems. The investigation was led by Brad Giese, the Chief Information Security Officer (CISO) of Iron Bow Technologies. The company’s endpoint detection and response mechanisms had logged activity related to an attempted exploit of its MOVEit application. The forensic analysis focused on determining whether the attempted exploit was successful and if any data exfiltration had occurred.

The investigation concluded that the company’s security controls were effective. Iron Bow Technologies determined that its endpoint detection mechanisms had successfully intercepted and halted the attempted exploit of the MOVEit application. As a result of this intervention, the attempted intrusion was not successful. The company confirmed that no data was exfiltrated from its systems as a result of this attack attempt. Based on these findings, Iron Bow Technologies publicly stated that it “was not impacted” by the MOVEit attack campaign, directly disputing the claims made by the Clop group on its dark web site.

The incident involving Iron Bow Technologies illustrates the broader context of the MOVEit attacks, where not every organization claimed as a victim by Clop had actually suffered a data breach. The company’s experience was one of a successful defensive action where pre-existing security measures prevented a breach despite the widespread exploitation of the critical vulnerability. The primary impact for Iron Bow was the resource expenditure required to conduct the forensic investigation to confirm its systems were secure and to publicly address the claims made by the cybercriminals. There was no evidence of any operational disruption, data theft, or financial loss directly attributable to the attack attempt on its MOVEit instance.

The response actions taken by Iron Bow Technologies were solely investigative and declarative. Upon learning of its listing on Clop's site, the company engaged in a forensic examination to ascertain the facts. After confirming the attempted exploit was defeated and no data was taken, the company issued a formal statement to clarify its status and deny the threat actor's claims. The company did not engage in any ransom negotiation or payment, as there was no evidence of data compromise that could be used for extortion. The incident was contained by the existing endpoint security tools that detected and blocked the attack attempt at the point of exploitation.