In May 2023, attackers exploited a critical SQL-injection vulnerability in MOVEit, a managed file-transfer product developed by Ipswitch and owned by Progress Software. Mandiant said exploitation began on May 27, after which the CL0P ransomware group used the LEMURLOOT web shell to access public-facing servers and steal files, including data stored in Microsoft Azure Blob Storage. Progress Software disclosed the vulnerability on May 31 and issued a patch, warning that it could enable privilege escalation and unauthorized access.
The incident became a systemic supply-chain breach rather than an isolated ransomware attack. More than 2,700 organizations and approximately 93.3 million individuals were ultimately affected, including the U.S. Department of Energy, Louisiana and Oregon motor-vehicle agencies, Nova Scotia’s government, and U.K. organizations such as the BBC, British Airways, Boots, Aer Lingus, and payroll provider Zellis. CISA and the FBI attributed the campaign to CL0P, described as a Russian-affiliated cyber gang; CL0P’s June 6 claim that government data had been deleted was later disproved. The breach prompted extensive incident response by CISA, the FBI, Mandiant, Microsoft, CrowdStrike, Huntress, and Rapid7, while exposing the risks of concentrating sensitive records in widely deployed third-party software.
