In late May 2023, the Cl0p ransomware group began exploiting a zero-day SQL injection vulnerability in MOVEit Transfer - a widely used managed file transfer application made by Progress Software. Over the following weeks, the campaign became one of the most significant mass exploitation events in history: Cl0p compromised hundreds of organizations across banking, healthcare, government, and critical infrastructure, exfiltrating data before most victims knew their systems had been touched. The breach count eventually exceeded 2,700 organizations globally, with approximately 93 million individuals affected. Notable victims included the US Department of Energy, Shell, British Airways, the BBC, PricewaterhouseCoopers, Ernst & Young, the University of California, the Oregon DMV, and the Louisiana Office of Motor Vehicles.
What made the MOVEit campaign architecturally distinctive was not the vulnerability itself but the exploitation strategy. Cl0p did not use ransomware. They did not encrypt files. They did not deploy persistent malware that required command and control infrastructure to operate. They exploited a web application vulnerability, extracted data, and left. The extortion was based entirely on the threat of publishing the stolen data - "pure" data extortion without any operational disruption. The approach was faster, required less infrastructure to defend, and was harder to attribute through traditional ransomware-era indicators. It was also, from Cl0p's perspective, dramatically more scalable.
The MOVEit Transfer Vulnerability
MOVEit Transfer is enterprise file transfer software used by organizations to manage the secure movement of files both internally and with external partners. It provides a web interface, API, and SFTP endpoints, and is particularly common in financial services, healthcare, and government, where regulated data transfer requirements exist and dedicated managed file transfer solutions are preferred over ad-hoc alternatives.
CVE-2023-34362 was a critical SQL injection vulnerability in MOVEit Transfer's web application. SQL injection vulnerabilities allow an attacker to inject their own SQL commands into queries that the application sends to its database. In this case, the vulnerability allowed unauthenticated access - an attacker did not need any credentials to exploit it. By sending crafted HTTP requests to the MOVEit Transfer web interface, an attacker could inject SQL commands that executed in the context of the database, ultimately achieving remote code execution on the underlying server.
Progress Software discovered the vulnerability and released a patch on May 31, 2023. But Cl0p had already been exploiting it. Forensic analysis of compromised systems later established that Cl0p had conducted testing of the vulnerability as early as July 2021 - almost two years before disclosure. They had identified the vulnerability, assessed its value, and held it until they were ready to conduct a mass exploitation campaign. When they moved, they moved simultaneously against hundreds of targets in a window before the patch was available and widely applied.
The Exploitation Timeline
The timeline of the MOVEit campaign has been reconstructed through forensic analysis of dozens of victim systems. The critical window appears to have been May 27-31, 2023 - the Memorial Day holiday weekend in the United States, a deliberately chosen time when security teams would be understaffed.
During this window, Cl0p's infrastructure sent exploitation requests to MOVEit Transfer instances accessible on the public internet. The requests installed the "human2.aspx" web shell, and automated scripts then executed file enumeration and data collection from each compromised instance. The operation was highly automated: the same shell, the same exfiltration commands, the same operational pattern repeated at scale across hundreds of organizations in a matter of days.
After the initial exploitation, Cl0p began issuing extortion demands. In a departure from typical ransomware practice, they gave victims until June 14, 2023 to contact them before they would begin publishing stolen data. This deadline and the follow-through on publishing created pressure even on organizations that had not initially known they were compromised.
Why No Ransomware?
The decision to use pure data extortion rather than ransomware reflects lessons learned over years of ransomware operations. Ransomware has several operational disadvantages for large-scale campaigns:
Encryption takes time, creates noise, and requires persistent access. Encrypting the files of a large organization requires running processes on many systems for extended periods, generates substantial I/O activity that endpoint detection tools may flag, and requires maintaining a foothold in the network during the encryption phase. For a mass exploitation campaign, the risk of detection during the encryption phase would have substantially reduced the number of successful compromises.
Ransomware payments require negotiation. Each ransomware victim is a separate negotiation with unpredictable outcomes. Data extortion can be scaled: Cl0p could set a published price and let victims self-select into paying or not, without investing negotiator time in each case.
Ransomware attracts FBI and CISA attention in ways that pure data theft sometimes does not. Once an organization's operations are disrupted, the incident receives immediate escalation to management and often to law enforcement. An organization whose data was stolen but operations were uninterrupted might not discover the breach for weeks - after which the window for active law enforcement response is longer.
The Victim Profile and Scale
The victim list in the MOVEit campaign spans essentially every sector of the economy. The breadth reflects MOVEit Transfer's market position: it is particularly common in organizations that handle regulated data (financial data, healthcare records, government documents) and need auditable file transfer workflows. These organizations tend to have more sensitive data than average, making them higher-value extortion targets.
Several of the most significant victims were hit not directly but through third parties: payroll processing company Zellis used MOVEit Transfer, and Zellis's breach led to exposure of employee data at British Airways, the BBC, and Boots the chemist, among others. The government of Nova Scotia used MOVEit. Teachers Insurance and Annuity Association (TIAA) was affected. The US Department of Energy's Office of Scientific and Technical Information confirmed data was stolen. Shell confirmed compromise. PricewaterhouseCoopers, Ernst & Young, and other professional services firms confirmed breaches.
The aggregate scale - 93 million individuals affected - makes MOVEit one of the largest data breach events in history by number of people affected. The nature of what was stolen varied by victim: employee records, patient data, financial records, tax information. The Oregon DMV breach exposed the driver's license information of 3.5 million Oregon residents. The Louisiana OMV breach similarly exposed several million records.
Attribution and the Cl0p Organization
Cl0p (spelled variously as Clop or Cl0p, with the zero being the group's stylistic choice) has been active since at least 2019 and is believed to operate primarily from Ukraine or Russia. The group is a ransomware-as-a-service operation with a core team that develops tools and infrastructure and a network of affiliates who conduct intrusions. The group's technical sophistication and operational security practices have improved substantially over the years.
Attribution of Cl0p to specific individuals or locations has been complicated by the use of infrastructure distributed across multiple countries and the group's operational security practices. In June 2021, Ukrainian law enforcement arrested six individuals in Ukraine connected to Cl0p operations. The arrests did not stop the group's activity - the core developers and operators were apparently not among those arrested, or the group's decentralized structure allowed operations to continue without them.
The US Department of State's Rewards for Justice program has offered up to $10 million for information leading to the identification or location of key Cl0p members. As of the time of writing, no additional arrests directly connected to Cl0p's leadership have been publicly announced.
The MFT Attack Surface
MOVEit was not an isolated case. The same year saw exploitation of vulnerabilities in GoAnywhere MFT (by Cl0p, in January 2023), Fortra's FileCatalyst Workflow, IBM Aspera Faspex, and other managed file transfer products. The pattern is consistent: file transfer software sits at the boundary between an organization and its external partners, is typically internet-facing, handles high-value data, and is often less aggressively patched and monitored than public-facing web applications.
From an attacker's perspective, file transfer software is an ideal target for mass exploitation campaigns precisely because of its deployment pattern: thousands of organizations running the same software, all with similarly sensitive data, all accessible from the internet. A single zero-day vulnerability provides simultaneous access to hundreds or thousands of targets. The ROI from vulnerability research is extraordinary if the target software has sufficient market penetration.
This insight has driven significant investment in file transfer software security research by both legitimate security researchers and offensive actors. It has also driven defensive responses: Progress Software, Fortra, and other vendors have substantially increased their security testing and response capabilities. But the fundamental architectural problem - that regulated organizations need to move files securely with external partners, and that meeting this need typically requires internet-accessible endpoints - does not have a clean solution beyond reducing the attack surface through strict allow-listing and zero-trust architecture around the file transfer function itself.