CISA and incident-response reporting place the start of the documented CL0P campaign against Progress MOVEit Transfer on May 27, 2023—the timeline anchor for this entry. Progress publicly disclosed the issue and shipped an initial patch on May 31, the CVE was assigned and added to CISA's Known Exploited Vulnerabilities catalog on June 2, and a joint CISA–FBI advisory (AA23-158A) followed on June 7. The attacker had a multi-day head start before defenders even had a name for the problem.
MOVEit reframed what a mass ransomware-adjacent event could look like. There was often no encryption at all—just theft, at scale, from systems built to hold exactly the kind of data attackers want.
CVE-2023-34362 is a pre-authentication SQL injection in the MOVEit Transfer web application's HTTP/S request handling. Its impact spans unauthorized database access, inference of schema and content, modification or deletion of data, and an attack path to web-shell deployment. The CVSS is 9.8 (Critical), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The initial advisory treated all versions before the May 2023 security releases as affected; CISA listed 2023.0.0 along with the 2022.1.x, 2022.0.x, 2021.1.x, 2021.0.x, 2020.1.x and 2020.0.x families. One caution deserves emphasis: the initial fixed-version numbers conflict across the supplied summaries—one source lists 2023.0.1, 2022.1.5, 2022.0.4, 2021.1.4 and 2021.0.6, another lists versions one revision later. This likely reflects successive updates rather than a single definitive list, so readers should be directed to the latest cumulative Progress release rather than a potentially superseded build list.
The timeline is striking for how compressed it was. Documented exploitation by CL0P began on May 27, 2023. Progress publicly disclosed the flaw and shipped an initial patch on May 31—just four days later. The CVE was assigned and added to CISA's Known Exploited Vulnerabilities catalog on June 2. Microsoft attributed the campaign to the actor it tracks as Lace Tempest on June 5, and CISA and the FBI published a joint advisory, AA23-158A, on June 7. In under two weeks, the event moved from silent mass exploitation to a coordinated government response—but by then the data theft had, for many victims, already happened. That gap between first exploitation and public patch is the window a well-prepared actor exploits, and it is why file-transfer software carries outsized risk.
The vulnerable web application accepted attacker-controlled HTTP/S data that reached database queries without sufficient separation between input and SQL instructions. An unauthenticated attacker could therefore alter the meaning of a backend query, inspect database structure and data, and issue unauthorized statements.
CL0P used that access as part of a SQL-injection-to-web-shell chain. The actor deployed a C# ASP.NET implant called LEMURLOOT, often as human2.aspx—a name resembling the legitimate human.aspx. The shell authenticated commands using a value supplied in the X-siLock-Comment HTTP header and returned a 404-style response to unauthorized requests, reducing obvious signs of an implant. LEMURLOOT could enumerate the database, retrieve files and Azure-related settings, execute commands, and create or delete privileged accounts—including an account named "Health Check Service." The observed objective emphasized theft from a system built specifically to hold and exchange valuable files.
CISA and the FBI attributed the campaign to the CL0P ransomware gang, also called TA505; Microsoft used the name Lace Tempest and attributed the activity on June 5. The group publicly claimed responsibility in early June and used stolen data for extortion.
Unlike conventional ransomware incidents centered on encryption, this campaign emphasized exfiltration and threats to publish data. The product's role as an enterprise file-transfer hub meant a single compromised installation could expose data belonging to many organizations or individuals at once—the concentration that made the campaign so efficient.
Reported counts vary over time and by source. One late-2023 account cited more than 2,000 organizations and millions of individuals, while another secondary source cited more than 2,700 organizations globally. These should be described as reported, date-bound campaign-impact estimates, not a single reconciled official total.
The distinction between direct and downstream impact is essential. An organization could be affected because its own MOVEit server was compromised, because a service provider's server held its data, or because its personal records were included in another entity's transfer files. Organization counts, affected-person notices and compromised-server counts each measure something different, and collapsing them into one number would mislead.
Triaging a compromised file-transfer server means pulling logs, .aspx artifacts and database exports for offline review. The Samsung T7 Portable SSD is fast, portable storage for incident-response evidence and forensic images.
Amazon Affiliate Link
Progress initially advised blocking HTTP and HTTPS access to MOVEit Transfer until patches could be applied. It also advised removing unauthorized files, clearing active sessions, reviewing logs, deleting malicious temporary ASP.NET artifacts and rotating service-account credentials.
CISA and the FBI published indicators and detection content for LEMURLOOT, telling defenders to search for human2.aspx, unexpected .aspx files, suspicious downloads and the unauthorized "Health Check Service" account. Additional MOVEit vulnerabilities—CVE-2023-35036 and CVE-2023-35708—prompted cumulative releases during June and should be kept separate from CVE-2023-34362. The lasting instruction is to install the latest supported release, not merely the first May 31 build.
MOVEit demonstrated the concentration risk of managed file-transfer platforms. These systems are attractive not simply because they are internet-facing, but because successful access immediately reaches curated, high-value data—the prize is already inside.
The campaign also illustrated scalable extortion without encryption. One actor could compromise many organizations through a single repeatable application flaw, steal data in a short window, and conduct extortion afterward. The provocative but accurate question it raised for defenders: why encrypt the network when the file-transfer server already contains the prize?