Scourge · May 31 2023

The Scourge of MOVEit

Chronicle

On 31 May 2023 Progress Software disclosed a critical SQL injection in its MOVEit Transfer file-transfer product. The Cl0p gang had already been exploiting it as a zero-day for at least four days, over the long Memorial Day weekend, to plant the LEMURLOOT web shell and carry data off in bulk. In the end more than 2,500 organisations were affected, with tens of millions of people involved, including public agencies, universities, banks and hospitals.

Lesson learned

It confirmed that file-transfer tools are a favourite target for mass data theft, and that a single flaw in a widely used product becomes the problem of thousands of companies and their customers.

Prayer of reparation

O MOVEit, who were meant to move files and moved them to the wrong side, keep our queries parameterised and our transfer servers from standing open to all. Amen.

How it is remembered

Remembered by keeping file-transfer servers behind controlled access, deleting transferred files no longer needed and hunting for signs of compromise even after patching.