New CrushFTP zero-day exploited in attacks to hijack servers

AI-suggested

In the absence of an official patch, European organizations should immediately undertake the following specific measures: 1) Conduct an inventory to identify all CrushFTP instances, prioritizing those exposed to the internet. 2) Restrict access to CrushFTP servers using network-level controls such as IP whitelisting, VPNs, or firewall rules to limit exposure to trusted users only. 3) Monitor server logs and network traffic for unusual authentication attempts, privilege escalations, or anomalous file operations indicative of exploitation attempts. 4) Temporarily disable or restrict administrative interfaces and remote access capabilities where feasible until a patch is available. 5) Employ intrusion detection/prevention systems (IDS/IPS) with updated signatures to detect potential exploit activity. 6) Engage with CrushFTP vendor channels and trusted cybersecurity advisories for timely updates and patches. 7) Prepare incident response plans specifically addressing potential compromise of file transfer servers, including data backup verification and forensic readiness. 8) Consider deploying application-layer proxies or web application firewalls (WAFs) to add an additional layer of filtering and protection.