SQL injection in MOVEit Transfer exploited by the CL0P ransomware gang (2023)
CISA and the FBI report that the CL0P ransomware gang exploited a SQL injection vulnerability (CVE-2023-34362) in Progress MOVEit Transfer beginning May 27, 2023, installing a web shell called LEMURLOOT.
What happened
- The advisory tells organisations to patch immediately, audit for unauthorised administrator accounts, and use network segmentation, multi-factor authentication and offline backups.#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability
The failure pattern
Watch the pattern: Known vulnerability left unremediated
Safeguards that address it
CollectSEA's engineering analysis of what would have prevented or contained this failure.
- Patch internet-facing transfer tools immediatelyTrack exposure of file-transfer systems and apply vendor fixes on an emergency timeline.
- Reduce what a transfer server can hold and reachDelete data after transfer, segment the server and alert on new administrator accounts or web shells.
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- ASI03 Identity and Privilege Abuse
- LLM03 Excessive Agency
- AC-3 Access Enforcement
- AC-5 Separation of Duties
- AC-6 Least Privilege
- RA-5 Vulnerability Monitoring and Scanning
- SI-2 Flaw Remediation
- RV.1.1 Gather vulnerability information from public sources
- RV.2.2 Plan and implement risk responses
- RV.3.4 Update the development process
- MAP 5.1 Estimate impacts from past uses and public incident reports
- Goal 4 Security patches
- CWE-862 Missing Authorization
- CWE-1395 Dependency on Vulnerable Third-Party Component
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
"ToolShell" vulnerabilities in on-premises SharePoint are exploited to steal server keys (2025)
Microsoft observed attackers exploiting on-premises SharePoint Server vulnerabilities (CVE-2025-53770 and CVE-2025-53771, related to CVE-2025-49704 and CVE-2025-49706) against internet-facing servers, with attempts as…
Log4Shell: remote code execution through JNDI lookups in Apache Log4j (2021)
CVE-2021-44228 (Log4Shell) affects Apache Log4j 2.0-beta9 through 2.14.1 and lets an unauthenticated remote actor execute arbitrary code through JNDI lookups.
Capital One cloud breach and an $80 million OCC penalty for weak cloud-migration risk assessment (2019)
The OCC assessed an $80 million civil money penalty against Capital One for failing to establish effective risk assessment processes before migrating significant IT operations to the public cloud and for not correcting…
Unpatched web-application vulnerability (Apache Struts) leads to the Equifax breach (2017)
Apache Struts CVE-2017-5638 parser bug left unpatched for 2 months; attackers executed arbitrary commands and accessed unencrypted databases of 147M Americans.
F5, Inc. discloses a cybersecurity incident with data taken without authorization (SEC 8-K, October 2025)
On August 9, 2025, F5, Inc. (the “Company”, “F5”, “we”, or “our”) learned that a highly sophisticated nation-state threat actor had gained unauthorized access to certain Company systems.
GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)
A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.