MOVEit Transfer: How Cl0p Ransomware Exploited One Vendor to Breach 2,700+ Organizations

The Anatomy of Mass Vendor Exploitation

In late May 2023, the Cl0p ransomware gang began exploiting a critical zero-day vulnerability in MOVEit Transfer, a managed file transfer (MFT) product developed by Progress Software. The vulnerability, tracked as CVE-2023-34362, was a SQL injection flaw that allowed unauthenticated attackers to access MOVEit Transfer databases and execute arbitrary code on affected servers. Within weeks, the exploitation had grown to affect more than 2,700 organizations and an estimated 90+ million individuals, making it one of the most consequential third-party risk events in cybersecurity history.

How the Attack Worked

The vulnerability resided in MOVEit Transfer's web application component. By sending specially crafted SQL injection payloads to the application, attackers could bypass authentication and interact directly with the underlying database. Cl0p used this access to deploy a custom web shell, which Mandiant named LEMURLOOT, to enumerate files, extract data, and maintain persistent access to compromised servers.

Evidence later emerged that Cl0p had been testing the MOVEit vulnerability as early as July 2021 and had conducted additional testing in April 2023 before launching the mass exploitation campaign over the U.S. Memorial Day weekend (May 27–28, 2023). This long testing window suggests the group recognized the scale of the opportunity and prepared accordingly.

Progress Software issued a patch on May 31, 2023, and CISA added CVE-2023-34362 to its Known Exploited Vulnerabilities (KEV) catalog on June 2, 2023, ordering federal agencies to patch within the prescribed timeline.

The Scale of the Impact

The MOVEit exploitation affected organizations across virtually every sector and geography. According to tracking by security firm Emsisoft, the confirmed victim count continued climbing through the second half of 2023:

Many victims were not direct MOVEit customers. Instead, they were compromised because their service providers, payroll processors, or other third-party vendors used MOVEit Transfer to handle sensitive data. This nth-party risk dynamic dramatically amplified the blast radius of the vulnerability.

The Cl0p Playbook: Data Theft Without Encryption

Notably, Cl0p did not deploy ransomware to encrypt victim systems in the MOVEit campaign. Instead, the group relied purely on data exfiltration and extortion, posting victim names on their leak site and threatening to release stolen data unless ransoms were paid. This approach reduced the group's operational complexity while still generating significant pressure on victims. Cl0p set June 14 as the initial deadline for victims to make contact, and subsequently began publishing data from organizations that refused to negotiate.

Third-Party Risk Management Implications

• Vendor inventory must include sub-processors. Many MOVEit victims were breached because their vendors used MOVEit. Without a comprehensive vendor inventory that includes fourth-party and nth-party dependencies, organizations cannot assess their true exposure.
• Patch management SLAs are essential. Cl0p exploited the vulnerability before most organizations could patch. TPRM contracts should include patch management SLAs for critical vulnerabilities, ideally requiring emergency patching within 24–48 hours of a critical CVE.
• Holiday and weekend exploitation is common. Cl0p timed the attack for Memorial Day weekend, when security staffing is reduced. Vendor risk assessments should evaluate whether vendors maintain 24/7 security operations coverage.
• Mass exploitation changes the threat model. Traditional vendor risk assessments often focus on targeted attacks. MOVEit demonstrates that mass exploitation of common software can affect thousands of organizations simultaneously, requiring TPRM programs to track which commercial software products are used across their vendor portfolio.

FAIR Risk Quantification

The MOVEit event challenges traditional risk quantification because a single vulnerability in a vendor product generated thousands of simultaneous loss events. A FAIR analysis should account for the conditional probability that if a vendor uses a widely deployed product like MOVEit, the organization is exposed to mass exploitation events with correlated losses across the entire vendor portfolio. This systemic risk dimension is increasingly important in TPRM as attackers shift toward mass exploitation of common infrastructure.