Analyzing Multi-Vector Ransomware Attack on Accellion File Transfer Appliance Server

Abstract

The aim of this paper is to analyze the Accellion File Transfer Attack. In December 2020, a group of malicious actors breached the Accellion FTA system. The FTA system is used to transfer mass amounts of data quickly and efficiently between multiple systems. Once Accellion's appliance was breached, malicious actors copied data and threatened to release the data onto the internet if not paid a ransom. In order to prevent this from taking place, Accellion, as well as multiple client companies, assisted breached establishments with defense solutions, customer support, and ransom advice. Our findings indicate that Accellion was breached through four separate exploits. The main hacking methodology used was an SQL injection. Once into the system, attackers could view which transferred data was sensitive due to it being flagged with a special “sensitive” mark. Our findings are valuable because they express how companies should go about handling ransomware attacks. Our findings also indicate a solution for this type of attack and how a company should respond if they are faced with a ransomware attack.