Accellion FTA exploitation campaign

Summary

From December 2020 into early 2021, attackers exploited multiple zero-day vulnerabilities in Accellion's legacy File Transfer Appliance (FTA) to deploy the DEWMODE web shell, steal data, and later extort some victims by threatening publication on the CL0P^_- LEAKS site. Mandiant's February 22, 2021 public report and its March 1, 2021 security assessment commissioned by Accellion describe two linked but analytically distinct phases: exploitation and theft tracked as UNC2546, and later extortion tracked as UNC2582.

This page uses the descriptive title Accellion FTA exploitation campaign because the vendor, defenders, and public advisories centered the incident on the compromised legacy appliance rather than a single operator brand. Public reporting also links the extortion phase to CL0P and notes overlap with prior FIN11 activity, but those labels are better treated here as attributed aliases around a broader exploitation-and-extortion chain rather than as the page title.

Naming and companion-page assessment

CISA and Accellion-linked reporting describe the incident in descriptive Accellion File Transfer Appliance terms.
Mandiant splits the operation into UNC2546 for exploitation and UNC2582 for later extortion activity.
The same Mandiant report says extortion notes claimed association with the CLOP ransomware team and notes overlaps with prior FIN11 operations, but it did not collapse all of those labels into one clean actor identity.
No companion Groups or People page is published in this pass. The operation is well sourced; the actor taxonomy around UNC2546, UNC2582, CL0P, and FIN11 remains more attribution-sensitive than the exploit-and-extortion chain itself.

Timeline

2020-12-16: Mandiant's March 1, 2021 assessment says the first known use of the December exploit was detected when an FTA anomaly detector tripped on a customer device.
2020-12-20: The same assessment says Accellion released patch FTA 9.12.380 to remediate CVE-2021-27101 and CVE-2021-27104.
2020-12-23: Accellion released FTA 9.12.411, increasing anomaly-detector checks from once per day to once per hour, according to Mandiant's assessment.
2021-01-20: Mandiant's assessment says the first known use of the January exploit occurred on January 20, 2021.
2021-01-22: The same assessment says Accellion learned of new anomalous activity through customer inquiries and issued a critical alert instructing FTA customers to shut down their systems immediately.
2021-01-25: Accellion released patch FTA 9.12.416 to remediate CVE-2021-27102 and CVE-2021-27103, according to the Mandiant assessment.
2021-02-22: Mandiant's public report said organizations compromised in December began receiving extortion emails in late January 2021 and that victim postings had continued into February.
2021-02-24: CISA published its advisory on exploitation of Accellion FTA.
2021-04-30: Accellion's end-of-life notice says the legacy FTA product reached end of life on April 30, 2021.

Org context

Because there is no standalone Orgs section in the current taxonomy, the key organizations are summarized here.

Accellion / Kiteworks

Accellion's end-of-life notice says FTA was a 20-year-old legacy product scheduled for end of life on April 30, 2021.
Mandiant's March 1, 2021 assessment says Accellion identified and patched the four exploited zero-days and that Mandiant validated the patch efficacy.
The same assessment says Accellion increased anomaly-detection frequency twice during the incident response, reflecting how much of the immediate defense burden fell on the vendor appliance itself.

Mandiant / incident response

Mandiant's February 22, 2021 report says exploitation began in mid-December 2020 against organizations in multiple sectors and countries.
Mandiant says the attackers used a web shell it named DEWMODE, then exfiltrated files and in some cases followed up weeks later with extortion messages.
Mandiant's full assessment says it reviewed source code, performed dynamic testing, and examined forensic images from affected FTA instances.

CISA and downstream defenders

CISA's advisory made the incident a broader public-defense issue rather than a vendor-only problem.
CISA framed the incident around exploitation of a legacy file-transfer appliance, which fits the same descriptive naming used here.

Operational chain

Attackers exploited multiple zero-day vulnerabilities in the legacy Accellion FTA appliance, first in December 2020 and again in January 2021, according to Mandiant's March 1, 2021 assessment.
Mandiant says the exploitation phase installed a custom web shell named DEWMODE on exposed FTA devices.
Using DEWMODE, the operators downloaded victim files and, in some cases, likely database dumps; Mandiant's report also says the tool included a cleanup routine that removed log references and deleted the web shell after use.
Weeks later, some victims received extortion emails threatening publication on the CL0P^_- LEAKS site unless payment was made. Mandiant tracks that later phase separately as UNC2582.
The incident therefore combined edge-device zero-day exploitation, data theft from a legacy transfer appliance, and subsequent extortion pressure, without every case necessarily including ransomware deployment.

Evidence and impact

Mandiant says multiple organizations across sectors and countries were affected, showing this was not a one-off compromise of a single tenant.
The same report says extortion emails explicitly claimed to be from the CLOP ransomware team, but Mandiant also notes that ransomware itself was not deployed in the Accellion incidents it described.
Mandiant's assessment says the exploited flaws were critical because they allowed unauthenticated remote code execution.
Accellion's end-of-life notice underscores the broader risk pattern: a legacy transfer platform nearing retirement remained important enough to attackers that it became the center of a high-impact zero-day campaign.

Defender takeaways

Retire or isolate legacy edge transfer appliances aggressively. The Accellion case shows how old but still trusted file-transfer infrastructure can become a high-value zero-day target.
Treat vendor instructions to shut down or remove exposed appliances as incident-response actions, not routine maintenance. Mandiant's timeline shows the January exploit forced exactly that step.
Hunt for both exploitation and post-theft pressure. The initial intrusion path and the later extortion path were linked, but they did not always look identical in logs or attribution.
Preserve and review appliance logs quickly. Mandiant says DEWMODE included cleanup behavior specifically meant to erase traces from web and admin logs.
Do not anchor the response on a single actor brand too early. In this case, descriptive incident naming is more durable than flattening UNC2546, UNC2582, CL0P, and FIN11 into one label.