2023Data breachVulnerability exploitationSupply chain
MOVEit Transfer mass exploitation
From 27 May 2023
Beginning on 27 May 2023, attackers exploited a SQL injection zero-day (CVE-2023-34362) in MOVEit Transfer, a managed file transfer product, installed a web shell called LEMURLOOT and stole data from many organisations. Victims were extorted with threats to publish the data rather than with encryption.
- Victim
- Organisations using Progress MOVEit Transfer, and the people whose data they held
- Sector
- Cross-sector
- Public attribution
- CISA and the FBI attributed the exploitation to the CL0P ransomware gang, also known as TA505.Cl0p profileTA505 profile
- Malware
- Cl0p
Impact
A large number of organisations worldwide, and their customers and employees, had data stolen (CISA).
Root cause
A zero-day vulnerability in an internet-facing file transfer application that held large volumes of sensitive data.
Lessons learned: the controls it teaches
- Inventory internet-facing file transfer services and patch them as emergencies.
- Minimise data stored on transfer platforms and delete files after transfer.
- Include suppliers' file transfer tools in third-party risk assessments.