Case study · 2023
MOVEit Transfer mass data theft, 2023
A SQL injection zero-day in a file transfer tool let one group steal data from organisations worldwide.
Supply chain · zero-day
What happened
- From 27 May 2023, the CL0P ransomware group (also tracked as TA505 and FIN11) exploited a previously unknown SQL injection flaw, CVE-2023-34362, in Progress Software’s MOVEit Transfer managed file transfer product.
- Internet-facing MOVEit Transfer servers were infected with a web shell named LEMURLOOT, often called human2.aspx to look like a legitimate file, and data was stolen from the underlying databases, in some cases within minutes.
- Progress announced the vulnerability on 31 May 2023. On 6 June, CL0P claimed the campaign on its leak site and began extorting victims. CISA and the FBI published joint advisory AA23-158A on 7 June 2023.
- Many victims were not MOVEit customers themselves: their data was held by suppliers, payroll providers and other third parties that ran the software.
Root cause
An unpatched (zero-day) SQL injection vulnerability in an internet-facing file transfer application allowed unauthenticated attackers to plant a web shell and read stored files. The group had run similar zero-day campaigns against other file transfer products (Accellion FTA in 2020–21 and GoAnywhere MFT in early 2023).
Control failures
- Sensitive files were kept on an internet-facing transfer server longer than needed, so there was a large store of data to steal.
- Limited visibility of which suppliers used the product and held the organisation’s data (fourth-party risk).
- Web shell creation and bulk downloads were not always detected quickly.
- Secure development: an injection flaw reached production in a security-focused product.
Lessons for GRC
- Inventory internet-facing applications that hold sensitive data, and set retention so transfer servers are not long-term archives.
- Ask key suppliers which file transfer and data-sharing tools they use, and include zero-day response in contracts and due diligence.
- Monitor for new files in web directories and unusual download volumes on transfer servers.
- Have an emergency patch and isolation playbook for critical internet-facing software, tested before it is needed.