Breach Disclosure: UC Berkeley

On Monday, March 29, 2021, multiple employees at UC Berkeley received emails from a threat actor claiming that their data was stolen and was going to be released. According to Portswigger, the emails contained a link to a sample of the stolen data. On March 31, 2021, The University of California Office of the President confirmed the breach, and that attackers gained access to UC Berekeley through their Accellion instance. The breach contained approximately 547,000 unique email addresses, social security numbers and other personal data.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The Accellion breach by the Cl0p ransomware group has affected a number of higher education institutions. A user on reddit posted a screenshot of the disclosure email from UC Berkeley.

Although there has been no definitive link between the Cl0p ransomware group and the UC Berkeley breach, such as a shame site posting for UC Berkeley, it is likely actors used the widely reported Accellion vulnerabilities to break into UC Berkeley. A number of ransomware groups use the scare tactics listed in the above email in order to bring a sense of panic to the affected organization. Brian Krebs wrote an article in April 2021 that details an email sent from Cl0p to customers of RaceTrac Petroleum, who was ransomwared by Cl0p earlier this year.

The 4 Accellion FTA 0-days used by Cl0p, as documented by Threatpost are listed in the ZeroFOX Vulnerability Intelligence Product under the following links:

• CVE-2021-27101 – SQL injection via a crafted Host header
• CVE-2021-27102 – OS command execution via a local web service call
• CVE-2021-27103 – SSRF via a crafted POST request
• CVE-2021-27104 – OS command execution via a crafted POST request