MOVEit and the MFT zero-day exploitation playbook

In May 2023 the Clop ransomware group quietly started exploiting an unpatched SQL injection in Progress Software’s MOVEit Transfer — days before anyone outside the attackers knew it existed. By the time the dust settled, more than 2,700 organizations and upward of 90 million individuals had data stolen through CVE-2023-34362, making it one of the largest single-vulnerability breaches on record (CISA, TechCrunch). It wasn’t an isolated incident — it was the clearest example yet of a pattern that keeps repeating against managed file transfer (MFT) software: find one flaw in an internet-facing appliance built to move sensitive data, and turn it into hundreds of breaches in a matter of days.

Root cause

MOVEit Transfer’s vulnerability was a textbook SQL injection: an unauthenticated attacker could send crafted input to the web application and manipulate backend SQL queries against MySQL, Microsoft SQL Server, or Azure SQL, escalating from unauthorized database access to remote code execution (Rapid7). Clop used it to drop a custom ASP.NET web shell — dubbed LEMURLOOT, typically written to disk as human2.aspx to blend in with MOVEit’s legitimate human.aspx — giving them a durable, authenticated-looking foothold for pulling files straight out of the transfer database (Mandiant). Forensic teams found evidence attackers had mapped the database schema in advance, meaning this wasn’t smash-and-grab improvisation — it was a prepared exploit chain, sat on for weeks, then fired against every internet-reachable MOVEit instance Clop could find.

The deeper problem is what MFT software is. Products like MOVEit, GoAnywhere, and Cleo exist specifically to sit at the network edge, accept authenticated (and sometimes unauthenticated) file uploads from external partners, and hold the resulting files — often full of PII, financial records, or healthcare data — until someone downstream picks them up. That’s three attractive properties stacked on one box: it has to be internet-facing by design, it processes untrusted external input as its core function, and the data sitting on it is exactly what a data-extortion crew wants. A vulnerability class that would be a moderate finding on an internal app becomes catastrophic on an MFT server because the “why would an attacker target this” question answers itself.

Blast radius

Clop’s MOVEit campaign wasn’t a slow-burn intrusion — CISA and the FBI described mass, opportunistic exploitation across a few days before switching to the extortion phase (CISA). Confirmed victims spanned government agencies (multiple U.S. federal agencies among them), airlines (British Airways, Aer Lingus), payroll provider Zellis and its downstream customers, the BBC, and the government of Nova Scotia — the breadth reflecting how MOVEit sits inside countless unrelated organizations’ back-office data flows (BankInfoSecurity). By late October 2023, tracking firm Emsisoft put the confirmed count at 2,559 organizations and over 66 million individuals, with later tallies climbing past 2,700 organizations and roughly 90+ million people as more downstream disclosures rolled in through 2024 (Cloudskope).

Notably, Clop didn’t encrypt anything. This was pure data-theft-and-extort: steal the files, then list victims on a leak site with a payment deadline. That’s become the default MFT playbook — encryption is optional, exposure of the stolen files is the leverage, and it’s fast to scale because the same exploit chain works against every unpatched instance simultaneously. It repeated almost exactly with the earlier GoAnywhere MFT SQLi/RCE (CVE-2023-0669) and again in December 2024 against Cleo’s Harmony, VLTrader, and LexiCom products, where Clop chained CVE-2024-50623 and CVE-2024-55956 — the second flaw shipped because the first patch was incomplete — to deploy a Java backdoor and hit organizations that thought they’d already remediated (Rapid7, BleepingComputer).

Remediation

Patch immediately and don’t stop there — Progress shipped fixes for CVE-2023-34362 within days, but two related SQLi flaws (CVE-2023-35036, CVE-2023-35708) surfaced shortly after in the same code paths, the same “one patch wasn’t the whole story” pattern seen later with Cleo. Treat a single advisory as the start of a remediation window, not the end.

For detection, CISA’s advisory (AA23-158A) published concrete IOCs worth hunting for regardless of which MFT product you run: unexpected .aspx files in the web root (human2.aspx for MOVEit specifically), new/unknown admin or service accounts created around the exploitation window, SQL injection patterns and anomalous query volume in application logs, and outbound connections to unfamiliar IPs shortly after suspicious file activity (CISA). CISA also published YARA and Sigma rules for LEMURLOOT specifically — run them even after patching, since a compromise that predates your patch won’t be undone by it.

Architecturally, stop treating MFT servers like ordinary web apps. Segment them into their own network zone with tightly scoped egress — a file transfer server has no legitimate reason to be initiating arbitrary outbound connections, so alerting on unexpected outbound data flows is one of the highest-signal detections available. Put a WAF in front of the web interface and use it to block known exploit patterns while you patch. Minimize what’s actually exposed to the internet: if partners can reach you over a VPN or IP allowlist instead of the open web, do that. And treat the underlying files as sensitive at rest — encrypt them, and don’t let the transfer server itself be the only thing standing between “in transit” and “exfiltrated.”

The bigger lesson

MOVEit, GoAnywhere, and Cleo aren’t unrelated incidents — they’re the same shape of failure recurring because MFT software occupies a structural sweet spot for attackers: internet-facing by requirement, processing untrusted input by design, and holding exactly the data a data-extortion crew wants to steal. That combination doesn’t exist for MFT alone — it applies to any edge appliance that ingests external data and holds something valuable afterward. If you run one, the operative question isn’t “has this been patched recently,” it’s “what happens to every file that’s touched this box if it’s compromised tomorrow” — and whether your network segmentation, egress monitoring, and patch cadence would actually catch it before it becomes the next mass-breach headline.