In late May 2023, the Clop ransomware gang began exploiting a critical zero-day vulnerability in MOVEit Transfer, a widely-used managed file transfer platform made by Progress Software. What started as a single SQL injection flaw quickly snowballed into one of the largest supply-chain breaches in history, affecting governments, universities, healthcare systems, and Fortune 500 companies.
The vulnerability: CVE-2023-34362
The flaw was a SQL injection vulnerability in MOVEit Transfer's web interface. An unauthenticated attacker could send a crafted request to alter database queries, ultimately gaining administrative access and deploying a webshell named LEMURLOOT. From there, Clop operators could list files, download data, and maintain persistence even after patching.
Why the blast radius was so large
MOVEit Transfer is not a niche product. It sits inside thousands of enterprises, government agencies, and service providers as the plumbing that moves sensitive files between organizations. When a hospital chain uses MOVEit to exchange patient records with insurers, and both sides are vulnerable, the breach cascades downstream. That is exactly what happened: a single vulnerable MOVEit server at a business-services provider could expose data belonging to dozens of that provider's customers.
Notable victims
- U.S. Department of Energy and multiple federal agencies
- British Airways, BBC, and Boots (via payroll provider Zellis)
- Shell, Siemens Energy, and Schneider Electric
- Major U.S. universities and state Medicaid agencies
- Credit-rating agencies and financial services firms
The extortion playbook
Clop did not encrypt files in the traditional ransomware sense. Instead they exfiltrated data and posted a ticking-clock notice on their dark-web leak site: pay within a deadline or the stolen files go public. This double-extortion model is now standard, but the MOVEit campaign was distinguished by its scale and by the fact that many victims had no direct relationship with Progress Software — they were simply customers of a customer.
The defensive lesson is stark: a vulnerability in software you did not write, running on infrastructure you do not manage, can still expose your data to the open internet. External exposure detection that watches file-transfer endpoints, subdomain takeovers, and leaked credentials across your entire vendor graph is the only way to close that blind spot.
“The Clop cybercrime gang's attacks on MoveIt Transfer customers have affected 2,095 organizations and 62,054,613 individuals.”