Supply chain · May 31, 2023 · 5 min
MOVEit: Cl0p came in through the program companies use to send files
MedellínSoftware · Medellín, Colombia
May 2023. A zero-day in Progress Software's MOVEit Transfer. Governments, universities, payrolls. The haul was not one server. It was the tool everyone used to “send data safely.”
medellinsoftware.com/story/moveit-cl0p-el-proveedor-de-archivos/
Flaw
CVE-2023-34362
Group
Cl0p
Month
May 2023
Type
Zero-day
MOVEit Transfer is the drawer where companies and governments send files they do not want in email. In May 2023, the Cl0p cartel exploited an unknown flaw — CVE-2023-34362 — and emptied those drawers before Progress published a patch.
CISA issued an alert. The victim list grew for weeks: transport departments, universities, payrolls of companies that did not know their HR vendor used MOVEit. Cl0p did not always encrypt. Sometimes it only stole, and published the threat.
It is the loud cousin of SolarWinds. There was no intelligence patience. There was an extortion queue against anyone who had installed the right product.
The question for anyone building APIs is the same: does the “safe” file leave through a service you do not control?
The desk
The file is public. The briefing is requested.
AI and deep military intelligence. Medellín.