Loading story…
Attackers exploited CVE-2023-34362, a critical SQL injection vulnerability in Progress Software’s MOVEit Transfer, to gain unauthorized access and steal organizational data. ReliaQuest observed exploitation beginning at least May 27, 2023, ahead of disclosure on May 31, but did not initially attribute the activity. Subsequent Kroll investigations identified threat actors primarily associated with CLOP exploiting the flaw during May and June. Affected releases included MOVEit Transfer 2023.0.0 and the 2022.1.x, 2022.0.x, 2021.1.x, and 2021.0.x families; Progress released patches and mitigation guidance.
Kroll identified two exfiltration methods: the predominant approach used a dropped web shell to inject a session or create a malicious account, then reauthenticated to transfer files through MOVEit. A second approach, seen in approximately 5% of Kroll’s global MOVEit engagements, used web-shell capabilities and MOVEit APIs to decrypt and exfiltrate files, supported by Python automation; multiple instances sent data to 5.34.180.205. Application-mediated transfers generated database log entries, while direct web-shell theft could lack corresponding logs unless MOVEit logging was enabled, making database logs alone insufficient to exclude data theft. Response guidance included disabling HTTP and HTTPS access, removing unauthorized files and accounts, resetting credentials, and applying patches.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
KonBriefing reported at least 131 organizations affected by Clop's MOVEit campaign as of June 28, 2023, with stolen personal information affecting millions of individuals. Reported victims included UCLA, New York City's Department of Education, government agencies, and financial institutions affected through compromised service provider PBI Research Services.
CVE-2023-34362 was discovered and disclosed on May 31, 2023, affecting multiple MOVEit Transfer release families. Successful exploitation could enable unauthorized access, potential privilege escalation, and access to or modification of database contents.
ReliaQuest observed exploitation of CVE-2023-34362 beginning at least May 27, 2023. Reports cited by ReliaQuest described attackers using the vulnerability to exfiltrate organizational data.
Kroll developed an automated approach to decrypt MOVEit data encrypted at rest during dead-box incident response. The capability supported attorney review, eDiscovery, and breach-notification processes.
Investigating MOVEit exploitation in May and June 2023, Kroll identified application-mediated file transfers and a second, direct web-shell method present in approximately 5% of its engagements, with the investigated activity primarily associated with CLOP. Kroll analyzed a CLOP Python automation script and observed direct exfiltration to 5.34.180.205; this method could leave no corresponding database log entries unless MOVEit logging was enabled.
ReliaQuest deployed threat-hunting packages on customer networks identified as using MOVEit and established detection rules for exploitation. It also updated its intelligence feeds with newly identified indicators of compromise.
Progress Software released patches for all supported MOVEit Transfer versions and mitigation guidance for CVE-2023-34362. The guidance included disabling HTTP and HTTPS access, removing unauthorized files and accounts, resetting credentials, and applying patches.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcekroll.com
Open sourcereliaquest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical pre-authentication flaw in Progress MOVEit Transfer, **CVE-2023-34362**, was actively exploited to compromise internet-facing managed file-transfer servers and steal customer data. The vulnerability allowed SQL injection over HTTP/HTTPS, enabling attackers to manipulate the database, establish privileged sessions, deploy the `human2.aspx` ASPX webshell, and access or exfiltrate stored files. Microsoft attributed the campaign to Lace Tempest, associated with the Cl0p extortion ecosystem; Cl0p subsequently demanded that victims make contact or face publication of stolen data. Technical analysis found that duplicate HTTP-header smuggling could bypass `MOVEitISAPI.dll` transaction restrictions and set attacker-controlled session variables. Those values reached vulnerable guest-access code, permitting creation of a `sysadmin` session, acquisition of an API token, and a path to remote code execution through resumable-upload metadata and unsafe .NET `BinaryFormatter` deserialization. Organizations were urged to apply Progress updates, restrict HTTP/HTTPS exposure until patched, hunt for `human2.aspx`, the `Health Check Service` account or session, and `X-siLock-*` headers, preserve logs, rotate relevant storage credentials, and rebuild compromised servers from trusted backups because patching alone does not remove persistence.
Sep 3, 2026
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Aug 15, 2026
Millions of employee records associated with major corporations were published on BreachForums by a user calling themselves Nam3L3ss, according to a December 2024 report linking the disclosures to Clop’s 2023 MOVEit Transfer attacks rather than newly reported intrusions. The datasets reportedly included more than 12 million Jones Lang LaSalle records, alongside records associated with Koch Industries, Bank of America, Xerox, Morgan Stanley, Brown-Forman, and Medibank. Exposed information included employee contact details, job titles, departments, and internal identifiers, increasing risks of targeted phishing, identity theft, and corporate espionage. Nam3L3ss denied direct affiliation with Clop and claimed to be redistributing previously stolen information to highlight corporate security failures. Clop exploited the MOVEit Transfer zero-day CVE-2023-34362 beginning in May 2023, stealing data for extortion without encrypting victims’ systems. The group required victims to initiate negotiations, began publicly naming organizations in June, and had named roughly 260 organizations by mid-August. Its subsequent use of clear-web sites and torrents made stolen files easier to redistribute, extending exposure beyond the initial campaign. The operation followed attacks against Accellion and GoAnywhere file-transfer products and reflected a broader shift toward data-theft-only extortion against large enterprises; Coveware reported that many GoAnywhere victims refused to pay for leak suppression. Organizations should assess both direct and third-party exposure, preserve incident evidence, monitor for employee-data abuse, and strengthen phishing defenses. Patching file-transfer systems, restricting public access, and maintaining asset inventories reduce future compromise risk but cannot retract already stolen data.
Oct 9, 2026