In late May 2023, the Clop ransomware group (also written Cl0p) began exploiting a zero-day SQL injection vulnerability in MOVEit Transfer, an enterprise managed file transfer (MFT) application widely used for secure file sharing in regulated industries. The vulnerability, CVE-2023-34362, allowed unauthenticated attackers to execute SQL injection and ultimately run arbitrary commands on MOVEit Transfer servers. Clop used automated exploitation tools to hit every internet-exposed MOVEit instance they could find, exfiltrating data from each.

The scale of what followed was extraordinary. By the time CISA and Progress Software (MOVEit's vendor) published advisories on June 1, 2023, Clop had already compromised hundreds of organizations. Over the following months, the total grew to over 2,700 confirmed victim organizations - making MOVEit the largest mass exploitation campaign by victim count in history at that point. The victims spanned every sector: US federal agencies (including the Department of Energy), state governments, universities, banks, healthcare systems, pension funds, airlines, and hundreds of others in dozens of countries. The common thread was MOVEit Transfer.

How Clop Executed the Campaign

Clop's MOVEit operation had been in preparation for months. Mandiant later determined that Clop had been testing the MOVEit vulnerability as early as July 2021 - nearly two years before exploitation began. The group used that time to understand the vulnerability, develop reliable exploitation tooling, and prepare for a mass campaign. When they activated in late May 2023, the scale and automation were impressive: hundreds of organizations were compromised within days.

The exploitation pattern was relatively simple: Clop used SQL injection in MOVEit's web interface to interact with the backend database, enumerate user accounts, and ultimately deploy a web shell (named "LEMURLOOT") that provided persistent access. From this web shell, automated tooling exfiltrated data stored on the MOVEit server - typically the files that organizations had uploaded to MOVEit for secure transfer, plus the configuration database containing MOVEit user accounts and their associated data.

Clop's model for the MOVEit campaign differed from traditional ransomware. Rather than deploying encryption (which would have immediately alerted victims and triggered incident response), Clop focused exclusively on data theft and extortion. They did not encrypt victim systems. Instead, they exfiltrated data and then approached victims with demands - pay or the stolen data would be published on Clop's data leak site. This "data-only extortion" approach allowed Clop to operate at far greater scale than encryption-based ransomware, since exfiltration was significantly faster and less operationally complex than deploying a ransomware binary across enterprise networks.

[TECHNICAL NOTE]
CVE-2023-34362 in MOVEit Transfer: the vulnerability was in MOVEit's web application's handling of user-supplied input to database queries. The application used SQL queries to check session tokens, and the session token value was not properly sanitized before being included in the query. By supplying a carefully crafted session token value, an attacker could inject SQL commands that executed in the context of the database. The exploitation chain: (1) SQL injection to enumerate database contents and identify admin users. (2) Session hijacking via injected SQL to gain an authenticated session as an admin. (3) Exploitation of admin functionality to upload a web shell (LEMURLOOT.aspx) to the MOVEit web root. (4) Via the web shell, execute commands to enumerate and exfiltrate files from MOVEit's storage. The vulnerability was particularly severe because MOVEit servers typically contain sensitive files that organizations had uploaded for secure transfer - often financial documents, HR records, medical files, and regulated data. Progress Software released a patch on June 1, 2023; Clop had begun mass exploitation approximately three days earlier. Multiple MOVEit vulnerabilities were subsequently disclosed (CVE-2023-35036, CVE-2023-35708), requiring additional patches.

The Victims and Scale

The breadth of MOVEit victims illustrated how a single vulnerability in a widely used file transfer product could cascade into thousands of organizations. MOVEit Transfer was particularly common in regulated industries - healthcare, financial services, government - where secure file transfer compliance requirements drove adoption. These were exactly the organizations with data valuable for extortion.

Among the high-profile US victims: the Oregon and Louisiana DMVs (combined 9 million driver's license records), the New York City school system (45,000 students' data), Maximus (a US government contractor serving Medicare and Medicaid programs, 11 million beneficiaries' records), Shell, Siemens Energy, PricewaterhouseCoopers, EY, Aon, the BBC, British Airways, and Boots the UK pharmacy chain. The UK victims shared a common thread: all used Zellis, a UK payroll provider that used MOVEit. A single compromise of Zellis's MOVEit instance cascaded to all of Zellis's clients.

The US Department of Energy confirmed it was among those compromised. The DOE data was exfiltrated from two DOE entities that used MOVEit. CISA offered technical assistance to all affected federal agencies. The scale of US government exposure in a single third-party software vulnerability was notable and reinforced debates about FISMA requirements for software supply chain security.

[WARNING]
The MOVEit campaign exposed a significant gap in how organizations think about file transfer software security. MFT applications like MOVEit sit at a privileged position in enterprise infrastructure: they are specifically used to move sensitive data, they are internet-exposed (to allow external parties to send and receive files), and they aggregate data from across the organization in one place. This combination - internet-exposed, data-aggregating, and trusted with regulated files - makes MFT platforms extremely high-value targets. Yet many organizations treat MFT software as an IT commodity rather than as security-critical infrastructure. The MOVEit campaign, combined with prior attacks against GoAnywhere MFT (also by Clop) and Accellion FTA (by a predecessor group), established MFT platforms as a priority attack surface. Post-MOVEit security guidance emphasized: prompt patching of internet-facing applications, network monitoring for unusual data access patterns on file transfer servers, and consideration of whether all MOVEit-accessible data was truly necessary to store on the server.

Clop's Track Record and the Supply Chain Amplification

Clop's MOVEit operation was not the first time the group had exploited a file transfer zero-day for mass theft. In early 2023, Clop had exploited a zero-day in Fortra's GoAnywhere MFT (CVE-2023-0669), hitting approximately 130 organizations. Before that, the group had used a zero-day in Accellion's legacy File Transfer Appliance in late 2020, hitting around 100 organizations. The pattern was clear: Clop had developed a specialization in finding and exploiting file transfer software zero-days for mass data theft operations.

The supply chain amplification effect - where a single compromise of a service provider (like Zellis) cascades to all that provider's clients - was the most operationally interesting aspect of the campaign. Clop didn't need to individually target BBC, British Airways, and Boots; it only needed to compromise Zellis. The downstream victims had no ability to control Zellis's MOVEit security posture; they were exposed by their service provider's choice and security practices. This asymmetry - where victims' security was determined by a supplier they didn't control - drove subsequent regulatory focus on third-party risk management and supply chain security requirements.

[IOC]
Clop / MOVEit indicators: web shell LEMURLOOT.aspx (and variations) deployed to MOVEit web application directory; typical paths: C:\MOVEit Transfer\wwwroot\ or similar. LEMURLOOT communicated via HTTP POST requests with a hardcoded password check; responses were Base64-encoded. Network indicators: anomalous outbound file transfer from MOVEit servers to external IPs; large POST requests to MOVEit from unexpected IP ranges. CVE-2023-34362 affected MOVEit Transfer versions before 2021.1.7, 2022.0.7, 2022.1.8, 2023.0.4. CISA advisory AA23-158A covers MOVEit indicators. Clop data leak site (publishing stolen data): cl0b[.]com and TOR mirrors. Clop group linked to TA505 (Proofpoint tracking), believed to be a financially motivated Ukrainian-associated group (not state-sponsored, unlike most major ransomware groups). Victims who did not pay saw their data published on Clop's site; payment amounts varied but were typically in the millions for large organizations. Most organizations declined to pay, resulting in mass data publication. CISA's STOPRANSOMWARE advisory #AA23-158A provides full remediation guidance.