Baitaphish
Security intelligence
SearchLatest briefing
Curated incident record

Accellion FTA exploitation and extortion across multiple organizations

Attackers exploited vulnerabilities in Accellion’s legacy File Transfer Appliance (FTA) product to access and steal data from multiple organizations, frequently followed by extortion. CISA published a joint advisory describing the exploitation, IOCs, and mitigation steps, and affected organizations issued breach notifications and updates. The incident illustrates both the risk of end-of-life file transfer appliances and the financial and regulatory consequences of third-party data exposure.
First reported February 24, 2021Vuln Exploitationmed overall confidence
Incident library
First reportedFebruary 24, 2021
ActivityActivity date not specified
Last updatedFeb 2, 2026, 12:00 AM UTC
Record confidencemed

Key facts

Affected

  • Organizations using Accellion FTA (including disclosed victims)
  • Individuals whose data was transferred/stored via affected FTA instances

Initial access

  • vuln

Impact

  • data_theft
  • extortion
  • financial_loss

Attribution

unknown low confidence

The CISA advisory describes the campaign and mitigations but does not provide definitive public attribution in the included materials.

CVEs and ATT&CK

CVEs

CVE-2021-27101 · medCVE-2021-27102 · medCVE-2021-27103 · medCVE-2021-27104 · med

ATT&CK techniques

T1190 · high
  • T1190: The campaign exploited internet-facing Accellion FTA systems to obtain initial access and exfiltrate data.

Mitigations

Now

  • Patch/upgrade Accellion FTA to a fixed versionCloses the specific weakness used for initial access and reduces the window for opportunistic exploitation.

Soon

  • Restrict or remove direct internet exposure for the affected serviceReduces the attack surface and limits repeat exploitation while validation and remediation are underway.

Later

  • Implement rapid vulnerability response SLAs and external attack-surface monitoringImproves time-to-patch and helps detect newly exposed assets or known-vulnerable versions before attackers do.

Detection ideas

Detect exploit attempts in web/WAF logs

Look for request paths/parameters and user agents matching published IOCs for the exploited vulnerability; alert on spikes from new source IPs.

Data sources: WAF logs, Reverse proxy logs, Web server access logs

Alert on suspicious web server child processes / web shells

Alert when web server processes (w3wp/httpd/nginx) spawn shells or write new executable/script files into web directories (e.g., *.aspx, *.jsp, *.php).

Data sources: EDR telemetry, Process creation logs, File creation events

Sources