From ff50d8a85b73c040c254bb83a92b2d79e8d433ba Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jun 2023 10:25:58 -0600 Subject: [PATCH 1/8] I Like to MOVEit, MOVEit --- .../windows_moveit_transfer_writing_aspx.yml | 67 +++++++++++++++++++ ...moveit_transfer_critical_vulnerability.yml | 30 +++++++++ 2 files changed, 97 insertions(+) create mode 100644 detections/endpoint/windows_moveit_transfer_writing_aspx.yml create mode 100644 stories/moveit_transfer_critical_vulnerability.yml diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml new file mode 100644 index 0000000000..dd5d06e9e2 --- /dev/null +++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml @@ -0,0 +1,67 @@ +name: Windows MOVEit Transfer Writing ASPX +id: c0ed2aca-5666-45b3-813f-ddfac3f3eda0 +version: 1 +date: '2023-06-01' +author: Michael Haag, Splunk +status: experimental +type: TTP +data_source: +- Sysmon Event ID 11 +description: This analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. This activity is indicative of the recent critical vulnerability found in MOVEit Transfer, where threat actors have been observed exploiting a zero-day vulnerability to install a malicious ASPX file (e.g., "human2.aspx") in the wwwroot directory. The injected file could then be used to exfiltrate sensitive data, including user credentials and file metadata. The vulnerability affects the MOVEit Transfer managed file transfer software developed by Progress, a subsidiary of US-based Progress Software Corporation. This analytic requires endpoint data reflecting process and filesystem activity. The identified process must be responsible for the creation of new ASPX or ASHX files in the specified directory. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name + Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\MOVEitTransfer\\wwwroot\\*") Filesystem.file_name + IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN (human2.aspx) by _time span=1h Filesystem.dest Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | + fields _time dest file_create_time file_name file_path process_name process_path + process] | dedup file_create_time | table dest file_create_time, file_name, file_path, + process_name | `windows_moveit_transfer_writing_aspx_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: + - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023 + - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/ + - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/ + - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/ +tags: + analytic_story: + - MOVEit Transfer Critical Vulnerability + asset_type: Endpoint + atomic_guid: [] + confidence: 100 + impact: 100 + message: The MOVEit application on $dest$ has written a new ASPX file to disk. + mitre_attack_id: + - T1190 + - T1133 + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + risk_score: 100 + required_fields: + - _time + - Filesystem.file_path + - Filesystem.process_id + - Filesystem.file_name + - Filesystem.file_hash + - Filesystem.user + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/moveit_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/stories/moveit_transfer_critical_vulnerability.yml b/stories/moveit_transfer_critical_vulnerability.yml new file mode 100644 index 0000000000..e4babedbe4 --- /dev/null +++ b/stories/moveit_transfer_critical_vulnerability.yml @@ -0,0 +1,30 @@ +name: MOVEit Transfer Critical Vulnerability +id: e8c05f9b-6ad4-45ac-8f5d-ff044da417c9 +version: 1 +date: '2023-06-01' +author: Michael Haag, Splunk +description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEit Transfer\wwwroot\ folder for unusual files. A patch is currently being tested +narrative: Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads. + The zero-day vulnerability has been exploited to steal data on a large scale from various organizations. The identity of the threat actors and the exact timeline of the exploitation remains unclear. However, it has been confirmed that multiple organizations have experienced breaches and data theft. + + In response to this critical situation, Progress released a security advisory warning customers of the vulnerability and providing mitigation strategies while a patch is being developed and tested. They urged customers to take immediate action to protect their MOVEit environments. They suggested blocking external traffic to ports 80 and 445 on the MOVEit server and checking the c:\MOVEit Transfer\wwwroot\ folder for unexpected files, including backups or large file downloads. + + Blocking these ports will prevent external access to the web UI, prevent some MOVEit Automation tasks from working, block APIs, and prevent the Outlook MOVEit plugin from working. However, SFTP and FTP/s protocols can continue to be used for file transfers. + + There is currently no detailed information about the zero-day vulnerability. But based on the ports blocked and the specific location to check for unusual files, the flaw is likely a web-facing vulnerability. + + While Progress hasn't officially confirmed that the vulnerability is being actively exploited, it's clear from several reports that multiple organizations have already had data stolen using this zero-day vulnerability. The exploitation appears very similar to the mass exploitation of a GoAnywhere MFT zero-day in January 2023 and the December 2020 zero-day exploitation of Accellion FTA servers. These were both managed file transfer platforms heavily exploited by the Clop ransomware gang to steal data and extort organizations. +references: + - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023 + - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/ + - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/ + - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/ +tags: + analytic_story: MOVEit Transfer Critical Vulnerability + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 9b056e45cfa92f459f8d51f7d7dd8aa2fa82656c Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jun 2023 11:09:57 -0600 Subject: [PATCH 2/8] Update moveit_transfer_critical_vulnerability.yml --- stories/moveit_transfer_critical_vulnerability.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/moveit_transfer_critical_vulnerability.yml b/stories/moveit_transfer_critical_vulnerability.yml index e4babedbe4..5deb23aae8 100644 --- a/stories/moveit_transfer_critical_vulnerability.yml +++ b/stories/moveit_transfer_critical_vulnerability.yml @@ -3,7 +3,7 @@ id: e8c05f9b-6ad4-45ac-8f5d-ff044da417c9 version: 1 date: '2023-06-01' author: Michael Haag, Splunk -description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEit Transfer\wwwroot\ folder for unusual files. A patch is currently being tested +description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEit Transfer\wwwroot\ folder for unusual files. A patch is currently being tested. narrative: Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads. The zero-day vulnerability has been exploited to steal data on a large scale from various organizations. The identity of the threat actors and the exact timeline of the exploitation remains unclear. However, it has been confirmed that multiple organizations have experienced breaches and data theft. From d62a3386047b8cd7772470fae43fd914d7f72cf4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Jun 2023 23:56:40 +0000 Subject: [PATCH 3/8] Bump docker from 6.0.0 to 6.1.3 Bumps [docker](https://github.com/docker/docker-py) from 6.0.0 to 6.1.3. - [Release notes](https://github.com/docker/docker-py/releases) - [Commits](https://github.com/docker/docker-py/compare/6.0.0...6.1.3) --- updated-dependencies: - dependency-name: docker dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 33378c2dd3..98a0cdbdd4 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1,5 @@ attackcti==0.3.9 -docker==6.0.0 +docker==6.1.3 GitPython==3.1.31 Jinja2==3.1.2 jsonschema==4.17.3 From ae6dcea7dc11c41dccbe23f02ec33175ac180d67 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 1 Jun 2023 23:56:52 +0000 Subject: [PATCH 4/8] Bump pydantic from 1.10.7 to 1.10.8 Bumps [pydantic](https://github.com/pydantic/pydantic) from 1.10.7 to 1.10.8. - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/v1.10.8/HISTORY.md) - [Commits](https://github.com/pydantic/pydantic/compare/v1.10.7...v1.10.8) --- updated-dependencies: - dependency-name: pydantic dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 33378c2dd3..b4b24018dd 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ jsonschema==4.17.3 mock==4.0.3 psutil==5.9.5 pycvesearch==1.2 -pydantic==1.10.7 +pydantic==1.10.8 pysigma==0.9.8 pysigma-backend-splunk==1.0.2 pytest==7.3.1 From 189278fd579662857b159ceb3d8f75b97d58dd87 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 6 Jun 2023 07:18:17 -0600 Subject: [PATCH 5/8] Update moveit_transfer_critical_vulnerability.yml --- stories/moveit_transfer_critical_vulnerability.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/moveit_transfer_critical_vulnerability.yml b/stories/moveit_transfer_critical_vulnerability.yml index 5deb23aae8..b4fe9dd261 100644 --- a/stories/moveit_transfer_critical_vulnerability.yml +++ b/stories/moveit_transfer_critical_vulnerability.yml @@ -3,11 +3,11 @@ id: e8c05f9b-6ad4-45ac-8f5d-ff044da417c9 version: 1 date: '2023-06-01' author: Michael Haag, Splunk -description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEit Transfer\wwwroot\ folder for unusual files. A patch is currently being tested. +description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEitTransfer\wwwroot\ folder for unusual files. A patch is currently being tested. narrative: Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads. The zero-day vulnerability has been exploited to steal data on a large scale from various organizations. The identity of the threat actors and the exact timeline of the exploitation remains unclear. However, it has been confirmed that multiple organizations have experienced breaches and data theft. - In response to this critical situation, Progress released a security advisory warning customers of the vulnerability and providing mitigation strategies while a patch is being developed and tested. They urged customers to take immediate action to protect their MOVEit environments. They suggested blocking external traffic to ports 80 and 445 on the MOVEit server and checking the c:\MOVEit Transfer\wwwroot\ folder for unexpected files, including backups or large file downloads. + In response to this critical situation, Progress released a security advisory warning customers of the vulnerability and providing mitigation strategies while a patch is being developed and tested. They urged customers to take immediate action to protect their MOVEit environments. They suggested blocking external traffic to ports 80 and 445 on the MOVEit server and checking the c:\MOVEitTransfer\wwwroot\ folder for unexpected files, including backups or large file downloads. Blocking these ports will prevent external access to the web UI, prevent some MOVEit Automation tasks from working, block APIs, and prevent the Outlook MOVEit plugin from working. However, SFTP and FTP/s protocols can continue to be used for file transfers. From 195db41ce0c81157df9690ff99bb75d5f83edcba Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 6 Jun 2023 07:36:03 -0600 Subject: [PATCH 6/8] Update windows_moveit_transfer_writing_aspx.yml --- detections/endpoint/windows_moveit_transfer_writing_aspx.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml index dd5d06e9e2..143ad61929 100644 --- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml +++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\MOVEitTransfer\\wwwroot\\*") Filesystem.file_name - IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN (human2.aspx) by _time span=1h Filesystem.dest Filesystem.file_create_time + IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN ("human2.aspx","_human2.aspx") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest file_create_time, file_name, file_path, From 9094cc726cbace73ee17f12fb9d23fb82c1b5b57 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 6 Jun 2023 07:58:58 -0600 Subject: [PATCH 7/8] Update windows_moveit_transfer_writing_aspx.yml --- detections/endpoint/windows_moveit_transfer_writing_aspx.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml index 143ad61929..5fa93817e8 100644 --- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml +++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml @@ -30,6 +30,7 @@ references: - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/ - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/ - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/ + - https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft tags: analytic_story: - MOVEit Transfer Critical Vulnerability From 42fb320d4ec62081c8b69a6e382b3dd374ae9fd7 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 6 Jun 2023 09:55:49 -0700 Subject: [PATCH 8/8] minor fixes --- .../windows_moveit_transfer_writing_aspx.yml | 4 ++++ stories/moveit_transfer_critical_vulnerability.yml | 13 +++++++------ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml index 5fa93817e8..37ca8da052 100644 --- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml +++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml @@ -59,6 +59,10 @@ tags: - Filesystem.file_name - Filesystem.file_hash - Filesystem.user + - Filesystem.file_create_time + - Processes.process_id + - Processes.process_name + - Processes.dest security_domain: endpoint tests: - name: True Positive Test diff --git a/stories/moveit_transfer_critical_vulnerability.yml b/stories/moveit_transfer_critical_vulnerability.yml index b4fe9dd261..dd2a45469a 100644 --- a/stories/moveit_transfer_critical_vulnerability.yml +++ b/stories/moveit_transfer_critical_vulnerability.yml @@ -4,16 +4,17 @@ version: 1 date: '2023-06-01' author: Michael Haag, Splunk description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEitTransfer\wwwroot\ folder for unusual files. A patch is currently being tested. -narrative: Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads. - The zero-day vulnerability has been exploited to steal data on a large scale from various organizations. The identity of the threat actors and the exact timeline of the exploitation remains unclear. However, it has been confirmed that multiple organizations have experienced breaches and data theft. +narrative: 'Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads.\ - In response to this critical situation, Progress released a security advisory warning customers of the vulnerability and providing mitigation strategies while a patch is being developed and tested. They urged customers to take immediate action to protect their MOVEit environments. They suggested blocking external traffic to ports 80 and 445 on the MOVEit server and checking the c:\MOVEitTransfer\wwwroot\ folder for unexpected files, including backups or large file downloads. + The zero-day vulnerability has been exploited to steal data on a large scale from various organizations. The identity of the threat actors and the exact timeline of the exploitation remains unclear. However, it has been confirmed that multiple organizations have experienced breaches and data theft.\ - Blocking these ports will prevent external access to the web UI, prevent some MOVEit Automation tasks from working, block APIs, and prevent the Outlook MOVEit plugin from working. However, SFTP and FTP/s protocols can continue to be used for file transfers. + In response to this critical situation, Progress released a security advisory warning customers of the vulnerability and providing mitigation strategies while a patch is being developed and tested. They urged customers to take immediate action to protect their MOVEit environments. They suggested blocking external traffic to ports 80 and 445 on the MOVEit server and checking the c:\MOVEitTransfer\wwwroot\ folder for unexpected files, including backups or large file downloads.\ - There is currently no detailed information about the zero-day vulnerability. But based on the ports blocked and the specific location to check for unusual files, the flaw is likely a web-facing vulnerability. + Blocking these ports will prevent external access to the web UI, prevent some MOVEit Automation tasks from working, block APIs, and prevent the Outlook MOVEit plugin from working. However, SFTP and FTP/s protocols can continue to be used for file transfers.\ + + There is currently no detailed information about the zero-day vulnerability. But based on the ports blocked and the specific location to check for unusual files, the flaw is likely a web-facing vulnerability.\ - While Progress hasn't officially confirmed that the vulnerability is being actively exploited, it's clear from several reports that multiple organizations have already had data stolen using this zero-day vulnerability. The exploitation appears very similar to the mass exploitation of a GoAnywhere MFT zero-day in January 2023 and the December 2020 zero-day exploitation of Accellion FTA servers. These were both managed file transfer platforms heavily exploited by the Clop ransomware gang to steal data and extort organizations. + While Progress has not officially confirmed that the vulnerability is being actively exploited, it is clear from several reports that multiple organizations have already had data stolen using this zero-day vulnerability. The exploitation appears very similar to the mass exploitation of a GoAnywhere MFT zero-day in January 2023 and the December 2020 zero-day exploitation of Accellion FTA servers. These were both managed file transfer platforms heavily exploited by the Clop ransomware gang to steal data and extort organizations.' references: - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023 - https://www.reddit.com/r/sysadmin/comments/13wxuej/critical_vulnerability_moveit_file_transfer/