A trusted transfer service became the intrusion route
The 2023 MOVEit Transfer campaign showed how a specialist file-transfer service can concentrate both sensitive data and access risk. Mandiant reported exploitation of the previously unknown CVE-2023-34362 from 27 May 2023, before Progress publicly disclosed the issue on 31 May. Its investigation described web shells and data theft. The joint FBI/CISA advisory later documented the CL0P campaign and the LEMURLOOT web shell.
This was an SQL injection vulnerability in the internet-facing transfer application. It should not be reduced to a story about users choosing weak passwords. The vulnerable web service itself provided the entry point, so a review limited to failed logins would start from the wrong model.
The perimeter contained the data people cared about
A managed transfer platform often exists because organisations need to exchange valuable files. That legitimate role is part of its risk: incoming documents, outgoing customer data and integration credentials may converge around one service.
The Singapore Cyber Security Agency's advisory described affected release lines and recommended updating, with temporary HTTP/HTTPS restrictions for organisations unable to do so immediately. It also explained which application functions those restrictions would interrupt. That operational detail matters: a temporary control needs an owner who understands the business process it disables.
| Question | Evidence to request | Why it changes the response |
|---|---|---|
| Was the service reachable during the window? | Edge configuration and access logs | Establishes which route needed investigation |
| What data was available? | Transfer history, retention policy, storage records | Helps bound potential data exposure |
| Was persistence present? | Vendor-guided artefact and account review | A software update alone does not remove every intrusion consequence |
| Which integrations trusted it? | Service accounts and application connections | Determines the scope of credential review |
This is a decision matrix for responders, not a report that FISRO inspected any affected organisation.
Patch status and compromise status are separate records
The first record asks whether the vulnerable code path is closed. The second asks whether someone already used it and what they could still access. Joining these into one checkbox creates an easy but misleading result: a machine marked patched while the investigation of earlier data access remains open.
For a historical exposure, retain the application release and change times, the internet exposure window, relevant application and database logs, and the available storage-access records. Preserve evidence before rebuilding. Use the vendor's current response guidance to identify malicious artefacts and review accounts and credentials; avoid treating a filename search as proof that a host is clean.
The response should include the data owner, not just the platform administrator. Technical responders can identify suspicious access, while the data owner can establish which files were sensitive, which partners supplied them and which downstream obligations require separate assessment.
The earlier file-transfer pattern
The FBI/CISA advisory places MOVEit alongside earlier attacks involving Accellion File Transfer Appliance and GoAnywhere MFT. The useful comparison is the concentration of valuable data at a specialised exchange boundary. It does not imply that those products shared the same vulnerability or identical exploitation mechanics.
FISRO's assessment is that transfer-service governance should include a maximum retention period, a clear software owner and a documented isolation procedure. Reducing unnecessary retained files cannot repair an application flaw, but it can reduce what remains available if the boundary fails.
A practical recovery handover
Give the service owner a short evidence package: affected release and remediation reference; exposure interval; relevant artefacts preserved; credentials reviewed or replaced; and a statement of what data access remains unresolved. Include an explicit decision about reintroducing network access and the person responsible for it.
An unresolved exposure estimate should stay visible. A failed log query, missing retention period or unavailable partner record is a limitation of the investigation, not evidence that data was safe.
Read the affected branches before selecting a patch
The FBI/CISA record lists affected MOVEit Transfer lines including 2023.0.0, 2022.1.x, 2022.0.x, 2021.1.x, 2021.0.x, 2020.1.x and 2020.0.x. Progress's response page was revised as additional vulnerabilities and fixes emerged in June. A later patch link on that page must not be presented as if it described only the first May issue.
| Historical population | Decision evidence | Separate recovery work |
|---|---|---|
2023.0.0 and the listed older branches |
Progress's dated patch/revision table for the exact product line | Assess the exposure interval and earlier access |
| A vendor-supported updated build | Full product release and advisory covering it | Check whether persistence or exposed accounts remain |
| Unsupported or ambiguous installation | Supplier assessment and supported migration path | Preserve evidence before replacing the environment |
Use the current supported release guidance for a system being maintained now. The historical branch list is an inventory starting point, not permission to leave another old branch unexamined.
Collect artefact evidence before cleanup
The public investigation described LEMURLOOT commonly appearing as human2.aspx, resembling the legitimate human.aspx. On an authorised Windows evidence copy with the conventional installation path, a narrow read-only file check is:
Get-ChildItem -LiteralPath 'C:\MOVEitTransfer\wwwroot' -Filter 'human2.aspx' |
Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc
Adjust the path from the installation record. A matching filename is a lead requiring content and provenance analysis; a missing file does not rule out earlier use, another name or removed evidence. Do not execute a suspected ASP.NET file or delete it before preservation.
Search the relevant web and application logs for the paths and actions in the vendor's guidance. Header-based indicators only help when those headers were actually recorded. Preserve account, database and transfer records to bound data access rather than relying exclusively on a web-shell filename.
What temporary web restrictions interrupt
Singapore's advisory explained that disabling HTTP and HTTPS access prevents the web interface and affects associated APIs, native automation integration and the Outlook add-in. It does not disable SFTP and FTP/S simply by blocking the web ports. Continued protocol availability is not evidence that an already compromised system is safe.
Have the service owner document which workflow stops and who can approve isolation. After remediation, use an explicit return-to-service decision tied to the software and investigation evidence.
Two earlier MFT incidents, with the comparison bounded
The joint advisory places MOVEit alongside Accellion FTA activity in 2020–2021 and GoAnywhere MFT activity in early 2023. The common operational feature is a specialised exchange service holding valuable files and integration authority. It is not evidence of a shared code flaw across the products.
The comparison supports limiting retained data, maintaining an owner who can isolate the transfer service and preserving evidence of exports. It does not support borrowing another product's indicators or patch instructions. For this case, the closure record must identify the MOVEit build, exposure window, artefacts reviewed, connected credentials addressed and unresolved data-access scope.