Qualys Hacked Using Accellion Zero-day Vulnerability

The report documents Clop ransomware's exploitation of Accellion FTA (including a disclosed zero-day and subsequent CVEs) to deploy web shells, exfiltrate sensitive files from multiple organizations, and publish stolen data on a darkweb leak site; it includes technical details (CVE-2021-27101/27102/27103/27104, web-shell file paths), observed victim incidents (Qualys, ExecuPharm, V Cargo, Bombardier, Fugro), and mitigation recommendations such as patching to FTA_9_12_432+, auditing accounts, and increasing access controls.