StatewardStateward
← Toutes les vulnérabilités
CRITICALSupply chaincurated

SC-MOVEIT-CLOP-2023

Managed file transfer · Progress MOVEit Transfer

Résumé

Starting 27 May 2023, the Clop extortion gang mass-exploited a SQL-injection zero-day, CVE-2023-34362, in Progress MOVEit Transfer, a managed file-transfer product that organizations use to move sensitive files. Before any patch existed, Clop hit internet-facing MOVEit servers across the world, planting a web shell called LEMURLOOT and stealing the contents of the underlying databases. There was no encryption and no ransomware downtime: Clop simply exfiltrated data and extorted victims by threatening to publish it on its leak site. Because MOVEit sits at the data's edge and is used by vendors of vendors, a single product flaw cascaded to about 2,770 organizations and roughly 95 million people, including governments, banks, and household-name companies. Progress patched on 31 May 2023, after exploitation was already widespread. It is the lesson that managed file-transfer and other internet-facing data apps are prime mass-exploitation targets.

How it happened

Clop did not break into thousands of companies one at a time; it broke into one product they all used. MOVEit Transfer is a managed file-transfer (MFT) application: an internet-facing web app whose entire job is to hold and shuttle organisations' sensitive files. Clop had found a SQL-injection zero-day in it and, rather than use it quietly, sat on it and then unleashed it at scale on 27 May 2023, before Progress (MOVEit's maker) knew it existed. Microsoft tracks the gang as Lace Tempest, part of the long-running FIN11/TA505 cluster, and Mandiant found it had been testing the MOVEit bug as far back as 2021.

The injection let them plant a web shell, a malicious script named human2.aspx (which researchers dubbed LEMURLOOT), on each vulnerable MOVEit server. The web shell gave them the keys to the MOVEit database: it could authenticate inbound requests with a hard-coded password, enumerate and download the stored files, steal the credentials to any connected Azure Blob cloud storage, and even create a hidden administrator user. There was no ransomware and no encryption: Clop simply stole the data and moved to data extortion, naming victims on its leak site and demanding payment by a deadline to avoid publication. Progress shipped an emergency patch on 31 May, but by then the mass theft was done.

The damage

MOVEit became the largest data-theft campaign of 2023, and one of the largest ever. By the security firm Emsisoft's running tally it reached about 2,770 organisations and roughly 95 million individuals. The victim list reads like a directory of public life: US federal agencies and the Department of Energy, state motor-vehicle departments that lost millions of driver-license records, and the BBC, British Airways, Boots, and Aer Lingus, most of them hit not directly but through a single shared payroll provider, Zellis, whose MOVEit server was breached. That fourth-party risk, your data leaking through a vendor's vendor you never chose, was the campaign's defining feature. Coveware estimated Clop earned $75 to $100 million from it, most of that from a handful of large payers.

Why MOVEit still matters

MOVEit confirmed that managed file-transfer products are honeypots: internet-facing, packed with everyone's most sensitive files, and therefore irresistible. Clop had run the exact same play before, against Accellion's file-transfer appliance in 2020 and GoAnywhere MFT in early 2023 (around 130 organisations), and ran it again in late 2024 against Cleo's file-transfer software, because the target class is so rich. Two lessons stand out. First, data extortion without encryption means good backups do not save you; preventing the theft is the only defence. Second, fourth-party risk is real: your data can leak through a vendor's vendor you never chose. So minimise and purge what a file-transfer system holds, patch these edge apps on the fastest possible SLA, watch for web shells and anomalous database reads, and map your exposure to widely used products before the next one is mass-exploited. The underlying flaw is tracked separately as CVE-2023-34362.

Comment le corriger

  • Patch MOVEit (CVE-2023-34362 and the follow-on SQL-injection CVEs) immediately, and take the server offline if you cannot patch fast.
  • Hunt for the LEMURLOOT web shell and other persistence, and assume any data in the MOVEit database was taken.
  • Rotate credentials, keys, and tokens stored in or reachable from the file-transfer system.
  • Notify affected downstream parties; with a shared file-transfer product, your breach is also your customers' breach.

Comment l’éviter

  • Treat internet-facing managed file-transfer and edge data apps as high-risk: minimal exposure, a fast vendor-patch SLA, and tight segmentation.
  • Do not let a file-transfer box hold or reach more data than it must; purge transferred files promptly and minimize retention.
  • Encrypt data at rest, and watch for web shells and anomalous database reads on these systems.
  • Map your third-party and fourth-party exposure to widely used products like MOVEit, so you can react fast when one is hit.
  • Prefer configurations that reduce internet-facing attack surface, and monitor vendor advisories for active zero-day exploitation.

Références

Vulnérabilités liées

Tout Supply chain →