[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [The MOVEit Zero-Day Vulnerability: How to Respond](/blog/the-moveit-0-day) Publish date July 11, 2025 {x} minute read # The MOVEit Zero-Day Vulnerability: How to Respond [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Steve Harrison](/team/steve-harrison) Vice President, Product Support Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The zero-day vulnerability in [Progress Software's](https://www.upguard.com/security-report/progress-software-corporation) MOVEit Transfer product is being exploited by the Clop ransomware gang and other copycat cybercriminal groups to expedite the theft of sensitive data from customer databases. To protect your organization from compromise, follow the recommended response actions in this blog. [Learn how UpGuard streamlines Vendor Risk Management >](https://www.upguard.com/product/vendorrisk) ## What is the MOVEit Zero Day Vulnerability The MOVEIT Transfer vulnerability (CVE-2023-35708) is a security vulnerability in MOVEit Transfer - a Managed File Transfer solution for transferring files securely between organizations. If exploited, this critical vulnerability could facilitate privileged escalation, allowing threat actors to access a MOVEit Transfer database and exfiltrate its data to their command-and-control servers. This zero-day was first discovered by[ Ransomware-as-a-Service](https://www.upguard.com/blog/what-is-ransomware-as-a-service) gang Lace Tempest, known for using the Cl0p ransomware malware. Here's an example of a ransomware message delivered by the Cl0p ransomware gang after exploiting CVE-2023-34362. Though the first instances of exploitation were officially confirmed on May 27, 2023, clop hackers may have been experimenting with[ cyberattacks connected to this vulnerability since 2021](https://www.kroll.com/en/insights/publications/cyber/clop-ransomware-moveit-transfer-vulnerability-cve-2023-34362). [Learn how to respond to the Fortigate SSL VPN vulnerability >](https://www.upguard.com/blog/how-to-respond-cve-2023-27997) ‍ [Learn how to defend against Ransomware Attacks >](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise) According to an announcement on their dark web leak site, Cl0p claims to have compromised 27 companies through this vulnerability across various sectors, including[ healthcare](https://www.upguard.com/industries/healthcare) and[ financial services](https://www.upguard.com/industries/financial-services). Among the prestigious names in this list[ is UK-based energy gain Shell](https://techcrunch.com/2023/06/15/moveit-clop-mass-hacks-banks-universities/). The United States government has confirmed that several federal agencies have also fallen victim to attacks linked to the MOVEit Transfer vulnerability, with[ two critical infrastructure entities likely to be included in this list](https://techcrunch.com/2023/06/16/us-confirms-federal-agencies-hit-by-moveit-breach-as-hackers-list-more-victims/). ## How Does Exploitation Happen? MOVEit transfer sends encrypted data over several protocols:  * SFTP (SSH) * FTPS  * Via an API linked to a webpage * Direct web page upload/download.  However, only the webpage feature is impacted by the exploit using an [SQL Injection vulnerability](https://www.upguard.com/blog/sql-injection). > An SQL Injection is a type of cyberattack where hackers enter commands into a log-in form to extract data from an underlying database. Attackers could also use SQL injection to learn about the structure of a MOVEit Transfer database in preparation for a future data breach, or delete databases to create extortion opportunities from resulting business disruptions - [similar to the tactics used in DDoS attacks](https://www.upguard.com/blog/what-is-a-ddos-attack).  Different forms of this cyberattack are maturing, with some resulting in extreme outcomes like leakage of the entire databases, unauthorized file access, and, ultimately, remote code execution. The broadening impact potential of these attacks has resulted in several overlapping vulnerabilities raised by NIST, including: * [CVE-2023-35708](https://nvd.nist.gov/vuln/detail/CVE-2023-35708) * [CVE-2023-35036](https://nvd.nist.gov/vuln/detail/CVE-2023-35036)[‍](https://nvd.nist.gov/vuln/detail/CVE-2023-34362) * [CVE-2023-34362](https://nvd.nist.gov/vuln/detail/CVE-2023-34362) ## How to Safeguard Your Business Against MOVEIT Cyberattacks These immediate cybersecurity responses should be actioned **before** patches are applied to reduce the risk of exploitation during the patching process. These response actions have been sourced from [Progress Software’s post](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023). ### Step 1: Disable all HTTP and HTTPS traffic to your MOVEit Transfer environment Configure your firewall to deny all HTTP and HTTPS traffic to MOVEit Transfer. Only reinstate traffic AFTER patches have been applied. > HTTP and HTTPS traffic to your MOVEit Transfer environment should be disabled on ports 80 and 443. **Note: **After disabling this traffic, SFTP and FTP protocols will continue operating as usual, but the following functions will not be operational: * Logging into MOVEit Transfer via the Web User Interface * Any MOVEit Automation tasks depending on the native MOVEit Transfer host * Any REST, Java, and .NET APIs. * The MOVEit Transfer Outlook add-on. A workaround for not being able to log in via the web UI is to use a remote desktop to connect to the Windows machine and then load https\://localhost/ [Learn more about Progress Software’s remote access policy >](https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2023/page/Security-Policies-Remote-Access_2.html?_ga=2.39855970.1944296155.1687746301-1479744364.1687746301&_gl=1*3gpccb*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4Nzc1Njk1My4yLjEuMTY4Nzc1ODQ2My41Ny4wLjA.) ### Step 2: Delete all Unauthorized Files and Accounts #### (i). Delete Human2.aspx and .cmdline files Find any instances of the following files and delete them. Also, delete any files where these names occur as prefixes. * human2.aspx * .cmdline #### (ii). Delete New files in the C:\MOVEitTransfer\wwwroot\ directory. The presence of human2.aspx files in this directory is evidence of exploitation in progress. Here’s an example of traffic in an IIS log during a live MOVEit exploit attack. #### (iii). Delete New files in C:\Windows\TEMP\\\[random]\ directory Look for files within the MOVEit Transfer server containing the extension \[.]cmdline and delete them. #### (iv). New APP\_WEB\_\[*random*].dll files To remove new APP\_WEB\_\[*random*].dll files, follow this process: * Stop IIS -* iisreset /stop* * Delete any new APP\_WEB\_\[*random*].dll files contained in C:\Windows\Microsoft. NET\Framework64\\\[*version*]\Temporary ASP. NET Files\root\\\[*random]\\\[random*]\\ * Start IIS -* iireset /start* #### (v). Remove all Unauthorized Accounts Prevent unauthorized access by removing all instances of unauthorized accounts. Refer to the documentation below for guidance. [How to manage user accounts in MOVEit Transfer >](https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2022/page/Users.html?_ga=2.231507807.1944296155.1687746301-1479744364.1687746301&_gl=1*1uhr40n*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4Nzc2MTMyOC4zLjAuMTY4Nzc2MTMyOC42MC4wLjA.) #### (vi). Remove all Active Sessions Remove all active sessions by signing in as a System Administrator, navigating to “Session Manager,” and selecting “Remove all Sessions.” #### (vii). Remove Downloads from Unknown IP Addresses Parse Moveit Transfer logs for any downloads initiated by unknown IP addresses.[ Refer to this documentation from Moveit](https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2022/page/Logs.html?_ga=2.203869264.1944296155.1687746301-1479744364.1687746301&_gl=1*gtv3jm*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4Nzc2MTMyOC4zLjEuMTY4Nzc2MjY4MC40OS4wLjA.) for guidance. #### (viii). Check Logs for GET /human2.aspx events The presence of these events is indicative of an automated attack chain attempting to deploy the human2.aspx web shell. #### (ix). Check for Unauthorized Access to Azure Blog Storage Keys Check Azure logs for events indicating access to storage keys and rotate any keys you suspect to be impacted. [How to manage Azure storage account access keys >](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal) ### Step 3: Reset Service Account Credentials After all of the above steps have been completed, update all user account passwords for all affected systems as well as your MOVEit Service Account. [How to change your Windows Service Account Password >](https://community.progress.com/s/article/Transfer-Automation-Change-Windows-Service-Account-Password) ### Step 4: Install MoveIT Transfer Patches Install patches for all affected versions of MOVEIT Transfer within your ecosystem. All affected versions of MOVEit Transfer and their corresponding patched fixes are listed below. * **Affected:** MOVEit Transfer 2023.0.0 (15.0) * **Fixed**: MOVEit Transfer 2023.0.2 (15.0.2) * [Download the fixed version](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) - **Affected: **MOVEit Transfer 2022.1.x (14.1)  - **Fixed: **MOVEit Transfer 2022.1.6 (14.1.6) - [Download the fixed version\ \ ](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) * **Affected: MOVEit Transfer 2022.0.x (14.0)** * **Fixed: MOVEit Transfer 2022.0.5 (14.0.5)** * [Download the fixed version\ \ ](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) * **Affected: **MOVEit Transfer 2021.1.x (13.1)  * **Fixed: **MOVEit Transfer 2021.1.5 (13.1.5) * [Download the fixed version\ \ ](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) * **Affected: **MOVEit Transfer 2021.0.x (13.0)  * **Fixed: **MOVEit Transfer 2021.0.7 (13.0.7) * [Download the fixed version\ \ ](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) * **Affected:** MOVEit Transfer 2020.1.x (12.1) * **Fixed: **Special patch (12.1) * [Download special patch\ \ ](https://community.progress.com/s/article/Vulnerability-May-2023-Fix-for-MOVEit-Transfer-2020-1-12-1) * **Affected: **MOVEit Transfer 2020.0.x (12.0) or older * **Fix:**[** **Must upgrade to a supported version\ \ ](https://community.progress.com/s/products/moveit/product-lifecycle) * **Affected: **MOVEit Cloud  * **Fixed: **Prod: 14.1.6.97 or 14.0.5.45  * All MOVEit Cloud systems should be fully patched ([see Cloud status page](https://status.moveitcloud.com/)). ### Step 5: Confirm Removal of Malicious Files and Accounts Repeat all the tasks in step 2. If any malicious files or accounts are found, delete them,[ reset service account credentials](https://community.progress.com/s/article/Transfer-Automation-Change-Windows-Service-Account-Password), and then repeat step 2 until no more indicators of compromise are found. ### Step 6: Apply the Latest Patches for CVE -2023-35708 The exploit tactics for this MOVEit Transfer vulnerability are continuously evolving. Keep your remediation efforts and cyber threat awareness sharpened by following the latest patch release news on[ this Progress Community page](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023). You can also track the latest updates about the MOveit Transfer and Moveit Cloud vulnerabilities on this[ Progress Security page](https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability?_ga=2.199108463.1944296155.1687746301-1479744364.1687746301&_gl=1*jz7629*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4NzgyMzk0OC41LjEuMTY4NzgyNDgwMi42MC4wLjA.). ### Step 7: Enable all HTTP and HTTPS Traffic to your MOVEit Transfer environment Now that all malicious files and accounts have been removed and patches have been applied, HTTP and HTTPS traffic can be reinstated to your MOVEit Transfer ecosystem. ### Step 8: Continuously Monitor for Indicators of Compromise Continuously monitor all endpoints and network traffic logs against the Indicators of Compromise provided by Progress Software. The IoC file can be downloaded[ at the bottom of this page.](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) Your monitoring efforts should extend to the third-party vendor network to prevent this zero-day vulnerability from facilitating[ third-party breaches](https://www.upguard.com/blog/third-party-breach). However, given the non-invasive policy of most[ reputable attack surface scanning solutions](https://www.upguard.com/product/breach-risk), these scans cannot confirm which versions of IT MOVE Transfer your vendors are running. UpGuard has created a workaround for this by updating its scanning capabilities to detect where MOVEit Transfer is running and if HTTP is running/accessible to the internet. > The UpGuard platform can detect potential MOVEit Transfer vulnerabilities by detecting the following risks:\ > \ > 1\. MOVEIt Transfer with HTTP or HTTPS port open detected.\ > 2\. MOVEIt Transfer has been detected with HTTP not available When these risks are detected, customers can send a personalized remediation request message or a[ customized risk assessment](https://www.upguard.com/product/security-questionnaires) addressing the specific IoCs of MOVEit Transfer from the UpGuard platform. ## Additional MOVEit Transfer Protection Strategies Follow these additional mitigation steps to further reduce your impact potential. * **Update Firewall Rules** - Configure your firewall to only permit MOVEit Transfer environment connections from trusted IP addresses. * **Update Remote Access Policies** - Only permit inbound connection requests from trusted IP addresses. For guidance on remote access management in the MOVEit Transfer environment, refer to this[ SySAdmin rule guide](https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2022/page/System-Remote-Access.html?_ga=2.207456339.1944296155.1687746301-1479744364.1687746301&_gl=1*1j04s6d*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4NzgyODUwMS42LjAuMTY4NzgyODUwMS42MC4wLjA.) and[ Remote Access guide](https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2022/page/Security-Policies-Remote-Access.html?_ga=2.207456339.1944296155.1687746301-1479744364.1687746301&_gl=1*1j04s6d*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4NzgyODUwMS42LjAuMTY4NzgyODUwMS42MC4wLjA.). * **Enable Multi-Factor Authentication **- Secure all MOVEit Transfer accounts with MFA, especially given the current heightened risk of these accounts being compromised in dark web forums. For guidance on applying MFA to MOVEit Transfer accounts,[ refer to this documentation.\ \ ](https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2022/page/Multi-Factor-Authentication.html?_ga=2.139380595.1944296155.1687746301-1479744364.1687746301&_gl=1*10oijld*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4NzgyODUwMS42LjAuMTY4NzgyODUwMS42MC4wLjA.)[Learn how UpGuard detects data leaks >\ \ ](https://www.upguard.com/product/breach-risk/threat-monitoring) * **Update Incident Response Plans** - Update[ your response plan](https://www.upguard.com/blog/creating-a-cyber-security-incident-response-plan) to address the remediation steps outlined above and the suggestions in this advisory by the[ Cybersecurity and Infrastructure Security Agency (CISA)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a). Also,[ bookmark this Progress Software blog](https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability?_ga=2.199108463.1944296155.1687746301-1479744364.1687746301&_gl=1*jz7629*_ga*MTQ3OTc0NDM2NC4xNjg3NzQ2MzAx*_ga_9JSNBCSF54*MTY4NzgyMzk0OC41LjEuMTY4NzgyNDgwMi42MC4wLjA.) to stay informed of any emerging updates impacting previous remediation suggestions. * **Unusual Network Traffic** - Monitor for unusual network traffic fluctuations, similar to the characteristics of[ exfiltration processes](https://www.upguard.com/blog/how-to-detect-data-exfiltration) and[ Advanced Persistent Threats (APTs).](https://www.upguard.com/blog/what-is-an-advanced-persistent-threat) How is the MOVEit Transfer Vulnerability Being Exploited? * **Implement Zero Trust** -[ A zero-trust architecture](https://www.upguard.com/blog/prevent-supply-chain-attacks-with-zero-trust-architecture) could prevent hackers from reaching your sensitive data after a network breach. Zero trust should, ideally, also be implemented throughout your supply chain to reduce the risk of incidents resulting from compromised third-party vendors. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 22, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)