The Cybersecurity and Infrastructure Security Agency warned that the Russian CL0P Ransomware Gang has attacked several U.S. federal agencies that use the managed transfer file application MOVEit, CNN reported Thursday.

The global hacking spree, which also affected hundreds of non-government entities in the U.S., was announced a week after CISA and the FBI issued a cybersecurity advisory about the Russian cybercriminal group.

The Department of Energy’s Oak Ridge Associated Universities, Johns Hopkins University and the University System of Georgia were among the institutions that admitted to being victims of the cyberattacks.

CISA officials told CNN that the attacks have not harmed federal agencies’ operations, and that they are providing assistance to those organizations.

Jen Easterly, CISA director and Wash100 awardee, noted that the CL0P Ransomware Gang was “largely opportunistic” in using MOVEit’s vulnerability to penetrate networks, but assured that the breaches have not made “significant impacts” on the victims.

“We are working urgently to understand impacts and ensure timely remediation,” said Eric Goldstein, CISA’s executive assistant director for cybersecurity.

Progress Software, maker of MOVEit, stated that it has “communicated with customers on the steps they need to take to further secure their environments.” The company added that it suspended the MOVEit Cloud while it works to resolve the issue.

Researchers with the Safe Documents program at the Defense Advanced Research Projects Agency have developed new tools and methods designed to mitigate cyber vulnerabilities in file formats.

The SafeDocs program was launched in 2018 with a goal of improving the security of electronic communications used in government and military operations, DARPA said Wednesday.

“Attackers abuse excessive complexity and ambiguity of document format rules to sneak in malicious payloads past the scanners,” said Sergey Bratus, SafeDocs program manager at DARPA’s information innovation office.

“SafeDocs’ formal methods approach helps uncover and eliminate the dark corners where the attackers love to hide. Resulting technologies make trusting incoming data via documents viable for many industries, including those dealing with critical infrastructure,” added Bratus.

The SafeDocs tools and methods are designed to address the complexity and ambiguity of modern file formats like the Portable Document Format by defining machine-readable descriptions of data formats.

Program researchers also developed automated software construction kits to create secure scanners using the simplified format subsets, a process which Bratus said addresses the root cause of vulnerabilities in scanners.

“Acting on an unchecked assumption is the recipe for code vulnerability,” said Bratus. “SafeDocs helps the programmer avoid implementation errors due to misunderstanding or accidental omission by generating the code automatically.”

The National Security Agency and the Cybersecurity and Infrastructure Security Agency have collaborated to urge organizations to protect baseboard management controllers in their server-class computers.

NSA and CISA on Wednesday issued a joint cybersecurity information sheet, which warns that cyber actors can exploit the remote management functionality of BMCs to disrupt a network infrastructure, disable servers’ security and manipulate stored data.

BMC firmware executes outside a server’s operating system and continues to function even if the server is shut down. BMC enables system administrators to remotely perform network configuration and management.

Malicious actors have found ways to abuse the capabilities of these controllers. According to the agencies, cybercriminals can deactivate trusted platform modules, Unified Extensible Firmware Interface Secure Boot and other cyber defense mechanisms.

The security agencies recommend that organizations harden their BMCs by changing default credentials upon the discovery of a threat, and keeping that information away from internet connection. They should also use strong passwords, enforce virtual local area network separation and regularly perform update checks.