ClosedPatched
Day · Jun 7, 2023
MOVEit Transfer zero-day: Cl0p mass data theft
Progress MOVEit Transfer
Updates on Jun 7, 2023
CISA and FBI publish joint advisory AA23-158A attributing the campaign to the Cl0p ransomware gang (TA505)
Source
Summary
Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.
Read the full incident →Advisories6
- MOVEit Transfer Critical Vulnerability (May 2023)Progress · May 31, 2023
- #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (AA23-158A)CISA · Jun 7, 2023
- NVD: CVE-2023-34362NVD
- NVD: CVE-2023-35036NVD
- NVD: CVE-2023-35708NVD
- CISA Known Exploited Vulnerabilities CatalogCISA · Jun 2, 2023
