Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

← Past incidents
ClosedPatched

MOVEit Transfer zero-day: Cl0p mass data theft

Progress MOVEit Transfer

Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.

Why this severity: CVSS 9.8 (NVD), zero-day, actively exploited (CISA KEV), known ransomware/extortion use

Started
May 27, 2023
Closed
Jun 16, 2023
CVEs
CVE-2023-34362CVE-2023-35036CVE-2023-35708

Follow this incident

Affected

  • CVE-2023-34362: before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1) (NVD)
  • CVE-2023-35036: before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), 2023.0.2 (15.0.2) (NVD)
  • CVE-2023-35708: before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3) (NVD)

Fixed in

  • 2021.0.8 (13.0.8)
  • 2021.1.6 (13.1.6)
  • 2022.0.6 (14.0.6)
  • 2022.1.7 (14.1.7)
  • 2023.0.3 (15.0.3)
  • Older branches: see vendor advisory

Updates by day6

▸Jun 16, 2023

Link #

  1. Third round of fixes for CVE-2023-35708 after a public proof of concept

    Source

▸Jun 9, 2023

Link #

  1. Progress fixes more SQL injection bugs found during code review (CVE-2023-35036)

    Source

▸Jun 7, 2023

Link #

  1. CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)

    Source

▸Jun 2, 2023

Link #

  1. CISA adds CVE-2023-34362 to the KEV catalog

▸May 31, 2023

Link #

  1. Progress discloses the critical MOVEit Transfer vulnerability and ships patches

    Source

▸May 27, 2023

Link #

  1. Earliest exploitation of the MOVEit Transfer zero-day seen by Mandiant

    Source

Advisories6

News & write-ups1

Notes & caveats

Victim disclosures continued for months after the fixes; closedAt marks the last vendor fix. Exploitation start per Mandiant.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo