MOVEit Transfer zero-day exploited for data theft and extortion (Cl0p campaign)
A critical vulnerability in Progress Software’s MOVEit Transfer product (CVE-2023-34362) was exploited at scale in 2023 to steal data from affected organizations and enable extortion. Progress published advisories and mitigation guidance, and CISA issued a joint advisory describing the exploitation and attributing the campaign to the Cl0p ransomware group. The event led to widespread breach notifications and material response costs for many victims across industries.
First reported May 31, 2023Vuln Exploitationhigh overall confidence
T1190: Attackers exploited an internet-facing application vulnerability in MOVEit Transfer to gain access and steal data.
Mitigations
Now
Patch/upgrade Progress MOVEit Transfer to a fixed versionCloses the specific weakness used for initial access and reduces the window for opportunistic exploitation.
Soon
Restrict or remove direct internet exposure for the affected serviceReduces the attack surface and limits repeat exploitation while validation and remediation are underway.
Later
Implement rapid vulnerability response SLAs and external attack-surface monitoringImproves time-to-patch and helps detect newly exposed assets or known-vulnerable versions before attackers do.
Detection ideas
Detect exploit attempts in web/WAF logs
Look for request paths/parameters and user agents matching published IOCs for the exploited vulnerability; alert on spikes from new source IPs.
Data sources: WAF logs, Reverse proxy logs, Web server access logs
Alert on suspicious web server child processes / web shells
Alert when web server processes (w3wp/httpd/nginx) spawn shells or write new executable/script files into web directories (e.g., *.aspx, *.jsp, *.php).
Data sources: EDR telemetry, Process creation logs, File creation events
