MOVEit Transfer, 2023: one vendor's zero-day, many organisations' breach.

The NVD entry for CVE-2023-34362 describes a SQL injection vulnerability in the MOVEit Transfer web application that could let an unauthenticated attacker gain access to its database. It was a zero-day: exploited before the vendor knew about it, so there was no patch to apply when the campaign began.

The CISA and FBI advisory AA23-158A attributes the campaign to CL0P (also known as TA505) and describes the LEMURLOOT web shell, written to target MOVEit Transfer and used to steal data from the underlying databases. The group used the stolen data for extortion.

The root cause for most victims was not something they configured. It was a third-party product exposed to the internet and holding sensitive files. That is why this case is about supplier risk, exposure and response speed more than about any one organisation's patching: the window between exploitation and a patch was days, and organisations that did not know they ran MOVEit, or where, lost time.

• Reach: the campaign affected many organisations, often through their own service providers. CISA's advisory gives estimates for TA505's activity in general, not a count for this campaign, so no figure is given here.
• Vendor disclosure: Progress described the discovery and its response in a Form 8-K filed in June 2023.
• SEC: Progress received an SEC subpoena on 2 October 2023; on 6 August 2024 the SEC told the company it had concluded its investigation and did not intend to recommend an enforcement action.
• Advice: AA23-158A recommends, among other things, prioritising the patching of known exploited vulnerabilities, phishing-resistant MFA, network segmentation, auditing administrative accounts with least privilege, and offline backups with a recovery plan.

• Knowing what is exposed: attack surface monitoring discovers your subdomains from Certificate Transparency logs, so internet-facing hosts you have forgotten show up, and flags expiring or expired certificates.
• Knowing your suppliers: the vendor register records each supplier, what it processes and its review date. Your team maintains the entries; there is no automated vendor scoring or monitoring.
• Testing your own applications: trytrustable dast runs OWASP ZAP and Nuclei against your applications, and the SDK's static analysis runs in CI. Neither can find an unknown flaw inside someone else's product.
• Responding: the incident management module records the timeline and regulatory deadlines, and the breach notification deadline calculator works out the reporting clocks for India and the GDPR.
• Logs to investigate with: AWS CloudTrail multi-region logging and GCP Data Access audit logs and log retention.

These are the checks TryTrustable runs today. None of them is a claim about what would have happened in this incident: they test whether the control is in place in your environment, continuously, and record the result as audit evidence.

• CISA and FBI advisory AA23-158A: #StopRansomware: CL0P ransomware gang exploits CVE-2023-34362 MOVEit vulnerability (7 June 2023)
• NIST National Vulnerability Database: CVE-2023-34362
• Progress Software Corporation, Form 8-K (event of 30 May 2023)
• Progress Software Corporation, Form 8-K of 7 August 2024: SEC investigation concluded

Every figure on this page is taken from the official documents listed here, read in October 2026. Regulatory findings quoted are the regulator's; where a company neither admitted nor denied them, or where proceedings are still open, the page says so. Not legal advice.

More case studies: all breach case studies · Research