Cybercriminals may have known about the MOVEit Transfer zero-day since mid-2021

Managed file transfer (MFT) software is a crucial tool for organizations to securely transfer large or sensitive files. However, a recently patched zero-day vulnerability in MOVEit Transfer, a popular MFT software, has caused significant concerns among its users.

Widely exploited zero-day

CVE-2023-34362 is a zero-day vulnerability that affected MOVEit Transfer and was widely exploited from May 27, causing alarm bells to ring throughout the cybersecurity community. Although a patch was eventually released, the attackers managed to steal a significant amount of data by exploiting the vulnerability. The scope of the attack remains unclear, but it is believed that multiple organizations have been affected.

Early Exploitation

However, new evidence suggests that the attackers may have known about the vulnerability since at least mid-2021. Security researchers at risk and financial advisory services firm Kroll found significant evidence indicating that exploitation or testing of the vulnerability may have started much earlier than was believed.

Testing for access

Kroll discovered that testing of access to organizations occurred on a few occasions where the attackers appear to have automated the process. Activity consistent with MOVEit Transfer exploitation occurred on April 27th, May 15th-16th, and May 22nd, indicating that the actors were testing access to organizations. It is suspected that the testing was likely automated and involved extracting information from the MOVEit Transfer servers to identify which organizations were vulnerable.

Manual testing

In the attacks that occurred in July 2021, the attackers appeared to be conducting more manual testing based on the length of the activity. However, they seemed to have switched to automated tools in subsequent activity, which lasted only minutes or even seconds.

Cl0p ransomware group involvement

An analysis of the IP addresses involved in the previous attacks pointed to the Cl0p ransomware group as the probable source of the attacks. In a message posted on its website, the ransomware gang claimed to have exploited the MOVEit zero-day to steal files from “hundreds of companies”. The group instructed victims to get in touch by June 14 to prevent their data from being leaked.

Victims come forward

As the news of the zero-day vulnerability exploit spread, more victims have come forward. The Nova Scotia government has confirmed that it was among the affected organizations. In the UK, payroll company Zellis has also confirmed that its client data was stolen.

The significance of the findings

These findings highlight the significant planning and preparation that likely precedes mass exploitation events. Attackers invest time and effort in identifying potentially exploitable vulnerabilities in widely used software such as MOVEit Transfer. Even after the vulnerability has been patched, organizations still need to be vigilant, as attackers may still look for ways to exploit vulnerabilities in legacy systems.

To mitigate risks, organizations can continuously monitor their systems for any unusual activity, update their software regularly, and perform regular vulnerability assessments. It is also important to have incident response and business continuity plans in place in case of a security breach.

The recent MOVEit Transfer zero-day exploit underscores the criticality of vulnerability management and the impact that a single vulnerability can have on an organization. As cybercriminals continue to look for new ways to exploit vulnerabilities, cybersecurity teams must remain vigilant and proactive, regularly updating their systems and practices. By leveraging the correct tools, approaches, and mindset, organizations can create a comprehensive cybersecurity strategy that is effective against the latest cyber threats.

Explore more

Top Data Engineering Trends Reshaping Business in 2025

As businesses rely more heavily on vast amounts of data, data engineering has evolved into a pivotal component of business strategy. Navigating the intricate landscape of data management, organizations are seeking the most advanced methods to leverage this abundant resource. The field is undergoing rapid transformation, with pivotal shifts unveiling new possibilities for innovation and operational efficiency. The goal of

Essential AI Skills Data Engineers Need in Modern Workflows

In today’s rapidly evolving tech industry, data engineers find themselves increasingly intertwined with artificial intelligence (AI) workflows. The fusion of AI into data engineering is not just a trend but a significant paradigm shift that enhances the capacity to derive insights from complex data systems. This guide aims to equip data engineers with vital AI skills for efficient integration in

Rust Revolutionizes Data Engineering, Outshining Python & Java

The field of data engineering has long operated under the dominance of languages like Python and Java, celebrated for their user-friendly syntax and scalability. However, recent advancements spotlight Rust, a newcomer to the scene, which promises significant improvements in performance and operational cost savings. In an industry where efficiency and scalability are paramount, Rust’s distinct advantages position it as a

Go Green with Dynamics 365: Boost Sustainability and Efficiency

Amid growing concerns over climate change and resource depletion, businesses worldwide are reassessing their operational models to meet sustainability goals. This shift from a conventional approach to a more eco-friendly one is driven by both regulatory frameworks and societal expectations. The integration of technology into business operations is pivotal for achieving these objectives. Microsoft Dynamics 365, a robust enterprise resource

Review of Shop Floor Insight v7.14

In today’s fast-paced manufacturing environment, the ability to streamline operations and enhance productivity is crucial. Shop Floor Insight v7.14 by Insight Works emerges as a compelling solution, aligning with these very needs. As a Manufacturing Execution System (MES) that integrates seamlessly with Dynamics 365 Business Central, this software release promises to significantly optimize shop floor processes. This review delves into