The cybersecurity landscape faces a significant new threat as the Cybersecurity and Infrastructure Security Agency (CISA) officially added a critical vulnerability in Progress Software’s MOVEit Transfer platform to its Known Exploited Vulnerabilities (KEV) Catalog. The flaw, tracked as CVE-2023-34362, represents a severe SQL injection vulnerability that threat actors have been actively exploiting since at least May 27, 2023, to deploy web shells and exfiltrate sensitive data from organizations worldwide.
The Exploit Mechanics
CVE-2023-34362 targets MOVEit Transfer, a widely used managed file transfer (MFT) solution employed by enterprises to securely move data between systems, partners, and customers. The vulnerability exists in the application’s guest access functionality, specifically within the guestaccess.aspx file, where attackers can inject malicious SQL commands through crafted HTTP POST requests.
Once the SQL injection is triggered, the attackers deploy a custom web shell dubbed LEMURLOOT by security researchers at Mandiant. This web shell masquerades as legitimate MOVEit components, using filenames such as human.aspx, human2.aspx, and _human2.aspx to blend in with normal application files. The earliest samples of LEMURLOOT were uploaded to VirusTotal beginning May 28, 2023, indicating rapid weaponization of the zero-day.
LEMURLOOT provides the threat actors with a tailored toolkit designed specifically for MOVEit Transfer environments. The web shell can enumerate files and folders, retrieve configuration information, and create or delete user accounts with hard-coded credentials. Most alarmingly, in multiple cases observed by incident responders, data theft occurred within minutes of the web shell being deployed, highlighting the speed at which the attackers operate.
Affected Systems
The vulnerability impacts MOVEit Transfer versions 2023.0.0 and earlier releases. Organizations across a wide range of industries have been affected, with confirmed victims located in Canada, India, the United States, Italy, Pakistan, and Germany. The scope of the breach extends beyond what incident responders have directly observed, as the scanning and exploitation were sourced from IP addresses in the 5.252.188.0/22 range, suggesting automated, widespread targeting.
Microsoft attributed the campaign to the threat group tracked as Lace Tempest on June 2, 2023, and further analysis by Mandiant linked the activity to FIN11, a financially motivated group known for ransomware and data theft extortion. On June 6, the CL0P ransomware group claimed responsibility on their data leak site, threatening to publish stolen data if victims did not pay extortion fees. This aligns with the group’s established pattern of exploiting file transfer vulnerabilities for mass data theft campaigns.
The impact extends beyond on-premises data. LEMURLOOT can also steal Azure Storage Blob information, including credentials, from MOVEit Transfer application settings, meaning organizations using Azure cloud storage for their MOVEit appliances may have had their cloud data compromised as well.
The Mitigation Strategy
Progress Software released patches for CVE-2023-34362 on May 31, 2023, and all organizations running MOVEit Transfer must apply these updates immediately. Beyond patching, security teams should conduct thorough reviews of their MOVEit systems for indicators of compromise, including checking for suspicious files masquerading as human.aspx or human2.aspx, reviewing HTTP logs for unusual POST requests to guestaccess.aspx, and monitoring for unauthorized user account creation.
Organizations should also revoke and rotate any credentials that may have been exposed through the MOVEit Transfer configuration settings, particularly Azure Storage credentials. Network-level blocking of the known exploitation IP range 5.252.188.0/22 can provide additional protection for systems awaiting patch deployment.
Lessons Learned
The MOVEit zero-day incident underscores several critical lessons for the cybersecurity community. First, managed file transfer solutions are high-value targets because they handle sensitive data by design. Organizations must treat MFT platforms with the same security rigor applied to other critical infrastructure. Second, the speed of exploitation and data exfiltration demonstrates that threat actors have refined their operations to capitalize on zero-day vulnerabilities within days of initial exploitation. Third, supply chain and third-party software risks remain a dominant attack vector that requires continuous monitoring and rapid patch management.
User Action Required
If your organization uses MOVEit Transfer, take immediate action. Apply the security patches released by Progress Software, conduct a comprehensive forensic review of your systems, and notify affected stakeholders if data exfiltration is confirmed. With Bitcoin trading at approximately $27,249 and the broader crypto market capitalization exceeding $800 billion, the intersection of cybersecurity and financial data protection has never been more critical. Report any confirmed exploitation to CISA and relevant law enforcement agencies to assist in tracking the scope of this campaign.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any investment decisions.
sql injection in a file transfer tool in 2023. you would think enterprise software vendors would sanitize inputs by now
right? and this was a managed file transfer solution handling who knows how many orgs data at once
MOVEit was handling data for government agencies and Fortune 500 companies. the blast radius of one unpatched input field is staggering
SQL injection in 2023 on enterprise software costing six figures in licensing. parameterized queries have been standard practice for 20 years
parameterized queries have been in every SQL tutorial since the 90s. zero excuse for a vendor charging enterprise license prices
parameterized queries standard since the 90s and enterprise vendors still ship SQL injection bugs in 2023. nothing changes
bobby_tables is right but the moveit situation is worse than standard sql injection. lemurloot was specifically built for this platform. human.aspx to blend in, hardcoded credentials to persist. this was a targeted toolchain not a script kiddie attempt
Tomasz Kowalski lemurloot being purpose-built for MOVEit is what makes this scary. this wasnt opportunistic, the clop gang invested in R&D for this specific target
Vesna J. lemurloot being purpose built for MOVEit is the scariest part. clop invested real RnD into understanding one specific file transfer tool. this was surgical not opportunistic
Henrik T. clop doing targeted RnD on one file transfer tool is the real story. most ransomware crews scan for anything open. this was surgical
bobby_tables_ parameterized queries since the 90s and progress software still shipped SQL injection in an enterprise product costing 6 figures. zero accountability
param_q_ parameterized queries since the 90s and Progress Software still shipped SQLi in a product that costs 6 figures. enterprise security is a joke
param_q_ six figure licensing and they couldnt run a basic input sanitization test suite. every SQL 101 course teaches parameterized queries on day one
LEMURLOOT masquerading as human.aspx is clever tbh. most SOC teams would scroll right past that in a log review
can confirm. human.aspx in an IIS log from a MOVEit server would look totally normal unless you knew the exact filenames to flag. stealthy naming convention
soc_tier1 human.aspx blending in is why behavioral EDR exists. filename allowlisting has been dead since 2015 but here we are
human.aspx naming was clever but any decent EDR should flag new web shell creation regardless of filename. tooling failed not the humans
soc_tier1 human.aspx blending in is exactly why filename-based detection is useless. need behavioral analysis on the request patterns not just file names
the guestaccess.aspx attack vector is brutal because MFT admins often leave guest access enabled for partner file transfers. its a feature that became a weapon
Clop invested R&D into building LEMURLOOT specifically for MOVEit. this wasnt a scanner finding random SQLi, it was targeted development for one product
the clop gang hit hundreds of orgs through one file transfer appliance that nobody patched because it was a maintenance window nightmare. enterprise IT is structurally broken
the Clop gang behind this hit hundreds of orgs. BBC, British Airways, US government agencies. all from one file transfer tool nobody thought to audit
bbc, british airways, us government agencies all hit through a file transfer tool. the blast radius of one SQL injection in moveit versions 2023.0.0 and below is genuinely staggering
the patch window on this was brutal. CISA added it to KEV on June 2 and half the victims got hit weeks later. enterprises literally cannot patch fast enough
Sigrun B. the enterprises that got hit in August had a 2 month patch window and still didnt do it. you cant fix that with better tooling
Sigrun B. weeks later is generous. some orgs were still unpatched in August. IT departments treat file transfer appliances like set-and-forget toasters