Loading malware…
10 distinct techniques documented for this family, organized by ATT&CK tactic.
They function as dormant backdoors, activated only when attackers submit specific HTTP requests containing commands or credentials.
“A backdoor user named Health Check Service is deleted from the users table.”
"create or delete MOVEit server user accounts"
A webshell appears as an innocent PHP, ASP, or JSP file sitting quietly in a web directory... They function as dormant backdoors, activated only when attackers submit specific HTTP requests containing commands or credentials.
“A backdoor user named Health Check Service is deleted from the users table.”
“Creates and inserts a new active session for this user into the application”
"read configuration information" / "potentially enable the theft of Azure system settings and the associated key and containers"
"The web shell also allowed threat actors to enumerate files and folders on the MOVEit Transfer server"
"view and download data from the database server" / "large volumes of files have been stolen from victims' MOVEit transfer systems"
“Examine MOVEit or firewall logs for large outbound network transfers from the MOVEit environment.”
The MOVEit Transfer exploitation in 2023 affected hundreds of organizations globally, with attackers deploying webshells named "human2.aspx" to maintain persistence and exfiltrate data.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.