MOVEit: patch, then look for the web shell

A zero-day in MOVEit Transfer is being mass-exploited. Patching isn’t enough if they were already in.

6 June 2023 · 1 min read

Last week Progress disclosed a critical SQL injection bug in MOVEit Transfer, its file transfer product. Attackers were already exploiting it before the announcement, and the Cl0p ransomware gang has now claimed it. They aren’t encrypting anything. They’re stealing files, then demanding money.

If you run MOVEit Transfer:

Apply the patch for your version now. If you can’t, block HTTP and HTTPS traffic to it until you can, as Progress advises.
Look for signs they got in first. The known sign is a web shell file named human2.aspx in the web folder, plus new or unexpected admin accounts.
Check logs from late May onward for large downloads and unknown IPs.
If you find anything, treat it as a data breach: work out which files were there, and get legal advice about who to tell.

If you don’t run it yourself, ask your suppliers, payroll provider and partners whether they do. Many of the victims will be companies that never heard of MOVEit.