MOVEit Transfer / Cl0p - SQL Injection Zero-Day → LEMURLOOT Web Shell → Mass Data Theft in Days → 2,600+ Organizations Extorted
CVE-2023-34362, a SQL injection flaw in Progress Software's MOVEit Transfer, gave unauthenticated attackers access to the underlying database of an application whose entire purpose is moving sensitive files between organizations. Cl0p exploited it as a zero-day. Fastly observed the earliest injection attempts on May 9, 2023 and Mandiant saw exploitation from May 27; Progress warned customers on May 31 and the CVE was assigned June 2. Microsoft attributed the campaign to Lace Tempest, a Cl0p affiliate, on June 5. The actors deployed a web shell called LEMURLOOT to enumerate and steal database contents. Reporting places the eventual toll around 2,600 organizations and 77 million people, reached through a campaign that was, in Mandiant's framing, measured in days rather than months. This is the template that Oracle EBS repeated two years later, and the one before it was Accellion and GoAnywhere: find one unauthenticated flaw in software that aggregates other people's data, harvest quietly at scale, then extort everyone at once.
Cl0p's target selection across Accellion FTA, GoAnywhere MFT and now MOVEit is not coincidence, it is a strategy. Managed file transfer products must be reachable from the internet so partners can upload to them. They are deployed at organizations that handle regulated data, because that is why you buy one instead of using email. And they hold that data in bulk, concentrated in one database, often for far longer than anyone intended because retention was never configured. One unauthenticated flaw in such a product therefore yields regulated data from hundreds of organizations without any of the per-victim effort a normal campaign requires - and the victims include entities that never bought MOVEit at all, because their payroll provider or insurer did.
Cl0p's prior targets: Accellion FTA (2021), GoAnywhere MFT (2023)
Effort per victim: Near zero once the flaw is found
Indirect victims: Organizations whose payroll, benefits or insurance provider ran it
Aggravating factor: Retention rarely configured, so old files were still present
SQL injection in 2023, in a product built to custody sensitive files, is worth pausing on. The class has been the top of the OWASP list for most of two decades and is entirely preventable with parameterized queries. Here it was reachable without authentication, which removes every compensating control that depends on knowing who is asking, and it led to the database rather than merely to the application. Subsequent related flaws - CVE-2023-35036 and CVE-2023-35708 - were found and patched over the following weeks, which is the usual pattern once researchers start looking hard at a codebase that has just been shown to have one.
Authentication required: None
Reached: The underlying database, not just application functions
Follow-on flaws: CVE-2023-35036 and CVE-2023-35708 in the following weeks
Preventable by: Parameterized queries - the oldest advice in application security
The web shell was written into the application's own directory structure with a name chosen to blend in with genuine MOVEit files, which is why casual inspection of the server did not reveal it. It provided the operators with the ability to enumerate the database, retrieve file listings and contents, and manage stolen data - effectively a purpose-built administrative console for theft, sitting inside the application. Importantly, it survived the initial patch for anyone who applied the fix without hunting for existing compromise, which is the recurring lesson of every mass-exploitation event: patching closes the door but does not evict whoever already walked through it.
Capability: Database enumeration, file listing and retrieval, stolen-data management
Location: Within the application's own directory structure
Critical point: Patching does not remove an implant already installed
Required action: Hunt for the web shell independently of applying the fix
The tempo is the operational lesson. Because exploitation was automated and required no per-target work, the actors moved through the exposed population faster than defenders could patch - Palo Alto's Xpanse counted around 2,674 MOVEit servers exposing HTTP or HTTPS at the time, and the harvest was largely complete before most organizations had finished reading the advisory. This is the same argument the site makes in its pattern on machine-speed chains, arriving two years before the AI-assisted cases: when exploitation is scripted against an internet-wide population, "patch promptly" is competing against a process that does not sleep, and the only controls that help are the ones already in place.
Campaign duration: Days, per Mandiant's assessment
Sequence: Harvest quietly first, extort publicly later
Defender problem: The harvest outran the patch cycle across the whole population
Consequence: Only pre-existing controls mattered
Nothing was encrypted. Cl0p named victims on a leak site and demanded payment to avoid publication, which is the model the group has run since Accellion. The disclosure tail ran for well over a year, and its shape is the part worth internalizing: many affected organizations had never heard of MOVEit, because the server belonged to their payroll processor, their benefits administrator, their pension provider or a state agency. Victims included government departments, universities, banks and health systems, most of them at second or third hand. If you cannot enumerate which of your suppliers hold your data and what software they run it on, you cannot answer whether an event like this affects you - and in 2023 almost nobody could.
Method: Data theft and leak-site extortion; no encryption
Disclosure tail: Well over a year as downstream victims were identified
Typical victim: An organization whose payroll or benefits provider ran MOVEit
The unanswerable question: Which of my suppliers hold my data, on what software?