AdvisoriesCISAAA23-158AJune 12, 2023
June 12, 2023
On May 27, 2023, the CL0P Ransomware Gang, also known as TA505, started exploiting a newly discovered vulnerability (CVE-2023-34362) in Progress Software's MOVEit Transfer, a managed file transfer solution. By infecting internet-facing MOVEit Transfer web applications with a web shell named LEMURLOOT, the gang gained unauthorized access to the underlying MOVEit Transfer databases and stole data. TA505 is known as one of the most prolific phishing groups in recent years.
June 12, 2023
This advisory is relevant if you use Progress Software’s MOVEit Transfer product. If this is you - this is a major event - as any file stored on the server, from any endpoint, is at risk. Because MOVEit Transfer is commonly run as a managed cloud service, with endpoints connecting to it for file sharing, vulnerability scanners will struggle to provide a true risk assessment. You should locate the endpoints in your environment that are interacting with MOVEit Transfer to assess your exposure.
Be immediately notified of new advisories and associated security tests
AdvisoryCISAAA24-207AJuly 25, 2024
