---
title: How to Protect Against the MOVEit Transfer Exploit
description: A MOVEit Transfer vulnerability lead to the breach of federal agencies. Here's what we know, and how to protect against the MOVEit Transfer vulnerability.
image: https://www.morphisec.com/hubfs/MOVEit.png
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# How to Protect Against the MOVEit Transfer Exploit

Posted by [Oren Dvoskin](https://1534169.hs-sites.com/author/oren-dvoskin) on June 23, 2023

Find me on:

[LinkedIn](https://www.linkedin.com/in/ordvoskin/)

- [Tweet](https://twitter.com/share)

The US Cybersecurity and Infrastructure Security Agency (CISA) [admitted](https://edition.cnn.com/2023/06/15/politics/us-government-hit-cybeattack/index.html) it is providing support to several Federal agencies that were breached following vulnerabilities exposed in the Progress (formerly Ipswitch) MOVEit Transfer solution. According to an [alert](https://www.cisa.gov/news-events/alerts/2023/06/15/progress-software-releases-security-advisory-moveit-transfer-vulnerability) and cybersecurity [advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a) published by CISA, the CL0P Ransomware Gang has been actively exploiting the vulnerabilities for data exfiltration and to execute remote commands on the target machines.  

![MOVEit Critical Vulerabilities](https://www.morphisec.com/hubfs/ezgif.com-gif-maker(2).png)

## What We Know About the MOVEit Transfer Vulnerability

First disclosed on May 31st 2023, [Progress](https://cve.report/vendor/progress) security confirmed three [critical vulnerabilities](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023) ([CVE-2023-34362](https://nvd.nist.gov/vuln/detail/CVE-2023-34362), [CVE-2023-35036](https://nvd.nist.gov/vuln/detail/CVE-2023-35036), [CVE-2023-35708](https://nvd.nist.gov/vuln/detail/CVE-2023-35708)) that can allow threat actors to attain escalated privileges and unauthorized access to the environment. In their advisory, Progress described immediate steps all MOVEit customers should deploy to remediate the vulnerability.  

A [technical analysis](https://www.cisa.gov/sites/default/files/2023-06/aa23-158a-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability_6.pdf) by CISA reveals that in May 2023, the CL0P group began exploiting the SQL injection vulnerability to install a web shell named LEMURLOOT on MOVEit servers, dropped as ‘human2.aspx’, and later renamed to ‘human.aspx’ ([VirusTotal](https://www.virustotal.com/gui/file/e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e)). The webshell, specifically designed to target the MOVEit platform, is a toolkit that includes multiple operational capabilities, including downloading files, as well as executing and manipulating Azure system settings, including the creation of admin users.  

The impact of the vulnerability is widespread. MOVEit Transfer is a popular Managed File Transfer (MFT) solution used by thousands of enterprises, primarily in the United States, including government agencies, banks, software vendors, and other organizations.  Victims, including Shell, the University Systems of Georgia, the BBC, and British Airways began receiving [ransom notes](https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-starts-extorting-moveit-data-theft-victims/) to prevent publishing the exfiltrated data.  

## Targeting Managed File Transfer (MFT) Solutions

Managed File Transfer solutions and Secure MFT (sMFT) are used to secure and automate the transfer of data and documents across and between organizations.  The solutions are typically deployed by large organizations to enable the secure sharing of sensitive information, often connecting public-facing interfaces, with content stored in internal and sensitive networks. 

The Russian-based CL0P (Clop) hacking group ([TA505](https://attack.mitre.org/groups/G0092/)), allegedly exploited vulnerabilities in other MFT solutions, including [Acellion’s](https://cve.report/vendor/accellion) FTA in 2020 and 2021, and Fortra’s GoAnywhere MFT solution earlier in 2023 ([CVE-2023-0669](https://nvd.nist.gov/vuln/detail/CVE-2023-0669)).  

MFT solutions are [tempting](https://www.reuters.com/technology/how-moveit-breach-shows-hackers-interest-corporate-file-transfer-tools-2023-06-16/) targets for threat actors. Compromising them allows access to information that was supposed to be safeguarded by the solutions; achieving control over the target machines enables access into the protected victim networks.   

This enables threat actors like CL0P to employ “[double extortion](https://www.cisa.gov/stopransomware/ransomware-guide)” tactics which allow data stealing and ransomware execution across target machines using the control which was achieved.  

The exploited vulnerabilities serve as an entry point for the threat actors to execute the later stages of the attack.  Once the initial phase is complete, attackers establish C2 communications, allowing them to drop payloads to execute the later phases. In previous incidents, CL0P has been observed to use [Truebot](https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/), which subsequently downloads [Cobalt Strike](https://www.spiceworks.com/it-security/endpoint-security/guest-article/edrs-cobalt-strike-threat-detection/) and [FlawedGrace](https://attack.mitre.org/software/S0383/) beacons.  

 

![Diagram of MOVEit Transfer Attack Stages](https://www.morphisec.com/hubfs/ezgif.com-gif-maker(3).png)

The MOVEit Transfer attack stages. Modified from: Forescout ([https://www.forescout.com/wp-content/uploads/2023/06/CVE-2023-34362.png](https://www.forescout.com/wp-content/uploads/2023/06/CVE-2023-34362.png)) 

 

While the initial stage of the attack exploits new vulnerabilities, the next phase drops malicious payloads using evasive and in-memory techniques to [bypass detection](https://blog.morphisec.com/fileless-malware-attacks) by the resident endpoint protection solutions.  

## Recommended Actions

Immediate mitigations include applying the security patches and following the instructions published by [Progress (MOVEit)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023), and updating IOCs, as published by [CISA](https://www.cisa.gov/sites/default/files/2023-06/aa23-158a-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability_6.pdf).  

### **MOVEit recommendations (Source: **[**Progress.com**](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023)**) ** 

- Review the Progress [Security Center](https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability) page with updates on the MOVEit Transfer and MOVEit Cloud Vulnerabilities.  
- Until application of the security patch(es) - disable all HTTP and HTTPs traffic to your MOVEit Transfer environment, specifically:  Modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443. 
- Review MOVEit and System audit logs for unexpected behavior, delete unauthorized files (‘human2.aspx’, ‘human.aspx’), and remove unauthorized user accounts, full analysis at [Forescout.com](https://www.forescout.com/resources/mass-exploitation-of-moveit-transfer-critical-vulnerability/)  

- Apply the recommended security patch(es), then restore HTTP/HTTPs traffic.  

| **Affected Version  **  | **Fixed Version **  |
| --- | --- |
| MOVEit Transfer 2023.0.x (15.0.x)    | MOVEit Transfer 2023.03 (15.0.3)  |
| MOVEit Transfer 2022.1.x (14.1.x)    | MOVEit Transfer 2022.1.7 (14.1.7)  |
| MOVEit Transfer 2022.0.x (14.0.x)    | MOVEit Transfer 2022.0.6 (14.0.6)  |
| MOVEit Transfer 2021.1.x (13.1.x)    | MOVEit Transfer 2021.1.6 (13.1.6)  |
| MOVEit Transfer 2021.0.x (13.0.x)    | MOVEit Transfer 2021.0.8 (13.0.8)  |
| MOVEit Transfer 2020.1.x (12.1)    | Must update to at least 2020.1.6 then apply DLL Drop-ins above    |
| MOVEit Transfer 2020.0.x (12.0) or older    | MUST upgrade to a supported version    |
| MOVEit Cloud    | Prod: 14.1.6.97 or 14.0.5.45    Test: 15.0.2.39    |

 

**For a complete list of** **Indications of Compromise ****(IOCs)**** associated with ****the CL0P group****’s exploitation of the ****MOVEit**** Transfer ****vulnerability**** visit: **[**CISA.gov**](https://www.cisa.gov/sites/default/files/2023-06/aa23-158a-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability_6.pdf)**. ** 

## How Morphisec Can Help

Morphisec’s products help protect against potential exploits and malicious payloads with the following capabilities:  

**Morphisec Vulnerability Visibility and Prioritization ** 

Morphisec’s [Vulnerability Visibility](https://www.morphisec.com/products/morphisec-scout-vulnerability-management) and Prioritization provides risk and usage-based prioritization of vulnerabilities. In this scenario, Morphisec assists in identifying the organization using an application with a known vulnerability, and prioritizes risk based on actual usage and information based on known exploitation of the vulnerabilities. This enables organizations to act swiftly to apply critical security patches.  

**Prevention of malicious payloads employing evasive and in-memory techniques ** 

In the case of attacks such as the MOVEit exploit, organizations must protect themselves against the later stages, and against attacks capable of evading the protection mechanisms provided by detection-based technologies. [Automated Moving Target Defense (AMTD)](https://www.morphisec.com/moving-target-defense) is an essential defense-in-depth layer since it stops threats without prior knowledge, and without a need to rely on signatures, IOCs, and behavioral patterns.

 

![Diagram of MOVEit Attack Stages, with Morphisec AMTD helping protect endpoints.](https://www.morphisec.com/hubfs/ezgif.com-gif-maker(4).png)

Mitigating the MOVEit attack stages using vulnerability prioritization and prevention of evasive malware . 

Modified from: Forescout ([https://www.forescout.com/wp-content/uploads/2023/06/CVE-2023-34362.png](https://www.forescout.com/wp-content/uploads/2023/06/CVE-2023-34362.png))

 

Morphisec by default protects the IIS Web services and MOVEit DMZ components which runs under the IIS web server. In an event of a WebShell execution leading to a backdoor (e.g. CobaltStrike, Metasploit) access to the system, Morphisec’s AMTD would provide protections since these backdoor frameworks are completely fileless and employ evasive techniques designed to bypass detection by endpoint protection solutions. Morphisec focuses on disabling the framework early in the attack chain by leveraging the true prevention capabilities of the AMTD technology. 

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/90e4b55e-7566-4ca0-84f9-3deaaa8c9ad2.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/90e4b55e-7566-4ca0-84f9-3deaaa8c9ad2)

**Morphisec prevented the following related attacks: ** 

| **Attack Framework**  | **Bypassed EDR**  |
| --- | --- |
| CobaltStrike         | CrowdStrike  SentinelOne  Microsoft Defender for Endpoints  Fortinet EDR (FortiEDR)   |
| Metasploit        | CrowdStrike  Microsoft Defender for Endpoints  Palo Alto Cortex XDR  Fortinet EDR (FortiEDR)   Sophos  McAfee  |

 

Code and memory exploitation techniques are among [the top ten](https://www.picussecurity.com/resource/the-top-ten-mitre-attck-techniques) most seen MITRE ATT&CK techniques. AMTD mitigates this risk by morphing memory and other system resources, making them essentially invisible to the threats that target them. As a layer in a defense-in-depth security posture, AMTD stops zero-day, fileless, and in-memory attacks, offering true Defense-in-Depth for endpoint, server and workload protection, with a negligible performance impact, with no additional headcount required.  

**Want to learn more? ** 

Morphisec is trusted by 7,000+ companies and prevents more than 30,000 attacks daily across more than nine million protected endpoints, servers and workloads on Windows and Linux devices. To learn more about the technology and why Gartner calls AMTD “[the future of cyber](https://blog.morphisec.com/automated-moving-target-defense-gartner),” read our whitepaper [Zero Trust + Moving Target Defense: The Ultimate Ransomware Strategy](https://engage.morphisec.com/the-ultimate-ransomware-strategy). 

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/8d928d32-c3d8-465e-9404-91a6f2196950.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/8d928d32-c3d8-465e-9404-91a6f2196950)

**Schedule a demo to see Morphisec in action** - [https://www.morphisec.com/schedule](https://www.morphisec.com/schedule)  

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/how-to-protect-against-the-moveit-transfer-exploit#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Oren Dvoskin",
    "url" : "https://1534169.hs-sites.com/author/oren-dvoskin"
  },
  "dateModified" : "2024-05-09T06:57:33.452Z",
  "datePublished" : "2023-06-23T16:20:00.000Z",
  "headline" : "How to Protect Against the MOVEit Transfer Exploit",
  "image" : [ "https://www.morphisec.com/hubfs/MOVEit.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/how-to-protect-against-the-moveit-transfer-exploit",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```