The managed file transfer (MFT) software solution MOVEit Transfer is under active attack by attackers from the Cl0p gang exploiting a critical zero-day vulnerability. MOVEit Transfer is an on-premise secure file transfer server that provides solutions for safely collecting, storing, managing, and distributing information between companies and their partners and clients. The vulnerability, which has not been given a CVE identifier yet, is a SQL injection flaw that when properly exploited allows the threat actors to escalate their privileges leading to remote code execution (RCE). Researchers state that the main sign that a server has been compromised is the presence of a webshell named “human2.asp”, located in the “c:\MOVEit Transfer\wwwroot\” public HTML folder, which when accessed will execute a script with various malicious commands. The execution of the script allows the threat actor to perform actions like downloading sensitive files and information, creating new privileged users, as well as conducting reconnaissance on the configured Azure Blob Storage account, allowing the threat actor to exfiltrate data directly from the victim’s Azure Blob Storage containers. As of May 31, 2023, there are roughly 2,500 instances of MOVEit Transfer exposed to the public internet, with the majority of them located in the United States, including US government entities. The Senior Manager of Rapid7’s Vulnerability Research team stated that there is evidence that the threat actors have already automated the exploitation of this vulnerability and begun to mass download data from affected companies. MOVEit Transfer’s developer is working to release a patch as soon as possible and urges its customers to immediately apply the mitigation techniques provided in the advisory linked below. These include first shutting down any MOVEit Transfer servers to perform a thorough investigation for indicators of compromise, or evidence of large file downloads. Next, administrators should disable all HTTP and HTTPs traffic to their MOVEit Transfer environments, including backups. This is not the first file transfer solution to be exploited by Cl0p actors this year; in February, they were attributed to exploiting a vulnerability in Fortra’s GoAnywhere MFT file-transfer product. This matter is still developing, so the technical details about the vulnerability and the exploitation are being withheld by the developer until the patch is released. CTIX analysts will continue to monitor this matter and will provide further information in future FLASH Updates.