Quick answer: In late May 2023, the Cl0p ransomware gang exploited a previously unknown flaw, CVE-2023-34362, in MOVEit Transfer, a file transfer product made by Progress Software. Cl0p stole data from hundreds of organizations that used MOVEit, including companies that only had their data processed by a supplier. Instead of encrypting systems, Cl0p demanded payment to keep the stolen data private.
| Key facts | |
|---|---|
| Date | Exploitation from late May 2023 |
| Software | Progress MOVEit Transfer |
| Vulnerability | CVE-2023-34362 (SQL injection, zero-day) |
| Attacker | Cl0p ransomware gang |
| Type of attack | Mass data theft and extortion |
| Impact | Data stolen from hundreds of organizations worldwide |
Timeline
- Late May 2023: Cl0p begins exploiting the unknown flaw in internet-facing MOVEit Transfer servers.
- 31 May 2023: Progress Software discloses the vulnerability and releases fixes.
- 7 June 2023: CISA and the FBI publish a joint advisory on Cl0p’s exploitation of MOVEit.
- June 2023 onwards: Victims are named as Cl0p lists them on its leak site.
What happened
MOVEit Transfer is used by businesses and governments to send large or sensitive files securely. In late May 2023, the Cl0p gang used a SQL injection flaw that nobody else knew about to break into MOVEit servers exposed to the internet, install a web shell and download stored files.
Because Cl0p hit many servers at once, the victims included payroll providers, universities, government agencies and large companies. Many people whose data was stolen had never heard of MOVEit, because a supplier used it on their behalf.
Extortion without encryption
Cl0p did not encrypt systems. It simply stole data and threatened to publish it unless victims paid. This approach is faster for attackers and harder for victims to recover from, because backups do not help when the problem is stolen data.
Lessons for your organization
- Limit what data sits in file transfer systems and delete files once transfers are complete.
- Patch internet-facing file transfer products immediately when fixes are released.
- Know which suppliers handle your data and what tools they use.
- Monitor file transfer servers for unusual large downloads.
- Remember that backups do not protect against data theft; minimizing stored data does.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. See our guide to supply chain attack vectors. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
What was the MOVEit breach?
A 2023 campaign in which the Cl0p gang exploited a zero-day flaw in MOVEit Transfer to steal data from hundreds of organizations.
What is CVE-2023-34362?
A SQL injection vulnerability in MOVEit Transfer that let attackers access and steal stored data.
Did Cl0p use ransomware in the MOVEit attacks?
No. Cl0p stole data and demanded payment to keep it private, without encrypting systems.
