Full Report
In this blog, we explore the long-term impact of the MOVEit exploitation and how defenders can stay vigilant and learn from the past.
Analysis Summary
# Incident Report: Widespread Exploitation of MOVEit Transfer Zero-Day
## Executive Summary
In late May 2023, the threat actor group **cl0p** launched a massive, automated exploitation campaign targeting a zero-day SQL injection vulnerability (CVE-2023-34362) in the MOVEit Transfer file transfer software. The campaign focused on rapid data exfiltration via web shells rather than traditional ransomware encryption. While the initial exploitation occurred in a concentrated "burst," the impact unfolded over months as the attackers processed and leaked data from hundreds of global organizations.
## Incident Details
- **Discovery Date:** Late May 2023
- **Incident Date:** May 2023 (Initial widespread burst)
- **Affected Organization:** Multiple (Progress Software / MOVEit Transfer customers)
- **Sector:** Cross-sector (Government, Finance, Healthcare, Education, etc.)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** May 27–31, 2023 (Peak activity)
- **Vector:** SQL Injection (SQLi)
- **Details:** Exploitation of CVE-2023-34362, a zero-day vulnerability in the MOVEit Transfer web interface.
### Lateral Movement
- **Details:** Notably, the threat actor (cl0p) demonstrated limited lateral movement. Tradecraft focused on staying within the context of the MOVEit service to access the underlying database and file storage.
### Data Exfiltration/Impact
- **Details:** Attackers deployed a specific web shell (often named `human2.aspx`) to interact with the MOVEit application. This allowed them to authenticate as administrative users, list files, and exfiltrate data stored on the server.
### Detection & Response
- **Discovery:** Customers observed unexplained intrusions and unauthorized file access in late May.
- **Response actions taken:** Progress Software released patches starting May 31, 2023. Organizations were advised to disable HTTP/HTTPS traffic to MOVEit environments immediately until patched.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2023-34362 (SQL Injection).
- **Persistence:** Deployment of custom ASPX web shells (`human2.aspx`) within the MOVEit web directory.
- **Privilege Escalation:** Use of SQL injection to grant administrative sessions or create unauthorized API tokens.
- **Defense Evasion:** Exploitation occurred via legitimate web ports (80/443); web shells were designed to blend into the MOVEit application environment.
- **Credential Access:** Extraction of MOVEit database credentials and session information.
- **Discovery:** Automated scanning for exposed MOVEit Transfer instances.
- **Lateral Movement:** Minimal; focused on "living off the land" within the MFT (Managed File Transfer) application.
- **Collection:** Automated scripts used to query the database and identify high-value files.
- **Exfiltration:** Data transferred out via the web shell interface or authorized file transfer protocols.
- **Impact:** Data breach and extortion; no evidence of network-wide encryption (ransomware).
## Impact Assessment
- **Financial:** Extremely high due to regulatory fines, legal fees, and extortion demands.
- **Data Breach:** Massive volume; millions of records containing PII (Personally Identifiable Information) across hundreds of organizations.
- **Operational:** Significant disruption during the emergency patching and forensic investigation phases.
- **Reputational:** High-profile impact for Progress Software and downstream organizations whose customer data was leaked.
## Indicators of Compromise
- **Network:** Access to `[target-ip]/human2.aspx` or similar unauthorized ASPX files.
- **File:** `human2.aspx` (Web shell), `LEMURLOOT` malware.
- **Behavioral:** Unexpected SQL service account activity, creation of new administrative users within the MOVEit interface, large outbound data transfers from MFT servers.
## Response Actions
- **Containment:** Disabling external access to MOVEit Transfer ports (80, 443).
- **Eradication:** Deleting unauthorized files/web shells and applying vendor-supplied security patches.
- **Recovery:** Rotating all credentials for the MOVEit service and underlying databases; performing forensic audits of file access logs.
## Lessons Learned
- **MFT Risks:** Managed File Transfer solutions are "single points of failure" because they store large volumes of sensitive data and are typically internet-facing.
- **Exploitation at Scale:** Attackers may gain more access than they can immediately process, leading to a "delayed" impact where victims are named months after the initial breach.
- **Shift in Tactics:** A move away from encryption toward pure exfiltration/extortion simplifies the attacker's workflow and avoids some detection mechanisms.
## Recommendations
- **Vulnerability Management:** Prioritize patching of all internet-facing edge devices and MFT solutions.
- **Principle of Least Privilege:** Limit the MOVEit service account's permissions on the host OS and the database.
- **Egress Filtering:** Restrict outbound connections from MFT servers to only known, necessary destinations.
- **Enhanced Monitoring:** Implement File Integrity Monitoring (FIM) on web server directories to detect the unauthorized creation of `.aspx` or `.php` files.