After the Russia-linked Clop ransomware gang claimed to hit 130 companies, victims are coming forward, many of which used Fortra's GoAnywhere file transfer tool
Context & Ripple Effects
This story is the opening move of Clop's 2023 campaign against managed file transfer software. Two days after victims came forward, sources reported that Fortra had assured GoAnywhere customers their data was safe even as some received ransom demands — a trust gap between vendor messaging and attacker leverage. A month later, NCC Group recorded a record 459 ransomware attacks in March, attributing the surge largely to GoAnywhere exploitation.
What makes this article worth revisiting is the pattern it set: Clop found that one zero-day in widely deployed transfer software yields mass victims at near-zero marginal cost, then ran the identical playbook months later against Progress' MOVEit, where analysis put the toll at 122 breached organizations and roughly 15 million people's data.
First-order effects
- Companies using Fortra's GoAnywhere now face extortion based on data exfiltrated through the tool, while Clop's claimed 130-company tally pressures each victim to disclose before the gang names them.
- Fortra carries direct reputational damage: having told customers their data was safe, it now confronts customers holding ransom demands that contradict that assurance.
Second-order effects
- Managed file transfer vendors become Clop's preferred target class — the MOVEit attacks show the gang re-arming the same supply-side approach against Progress rather than moving on.
- Enterprise buyers respond by treating file transfer software as high-risk attack surface, pushing vendors toward faster disclosure and patching commitments to protect sales.
Third-order effects
- If one exploited zero-day can compromise over a hundred organizations per product, security economics shift from defending individual endpoints to scrutinizing shared infrastructure vendors — and regulators face mounting pressure over software liability for exactly this kind of single-point-of-failure code.
- A group like Clop operating with apparent impunity from Russia and Ukraine, as profiling coverage describes, keeps ransomware volume structurally elevated because attribution carries no enforcement consequence.
The trend: Ransomware is industrializing around mass exploitation of single enterprise software products, with one zero-day in a widely used tool replacing hundreds of individual intrusions.