{"data":{"case":{"actions":{"de":["Aktualisiere MOVEit Transfer auf eine aktuelle, unterstützte Version; alle Versionen vor den Fixes von Mai bis Juli 2023 haben bekannte kritische Lücken.","Lief auf dem Server 2023 eine ältere Version, prüfe ihn auf Spuren eines Angriffs: eine Datei namens **human2.aspx**, Benutzerkonten, die du nicht angelegt hast, und große Downloads.","Frag deine Dienstleister, ob sie MOVEit Transfer nutzen: Manche Opfer wurden über den Server eines Dienstleisters getroffen."],"en":["Update MOVEit Transfer to a current, supported version; all releases before the fixes of May to July 2023 contain known critical flaws.","If the server ran an older version in 2023, check it for signs of attack: a file named **human2.aspx**, user accounts you did not create, and large downloads.","Ask your service providers whether they use MOVEit Transfer: some victims were hit through a provider's server."]},"criteria":{"damage":{"de":"Meldungen von Datenpannen betreffen die Daten von 95.788.491 Menschen; manche sind womöglich doppelt gezählt (Emsisoft, 28. Juni 2024).","en":"Breach notices cover the data of 95,788,491 people; some may be counted twice (Emsisoft, June 28, 2024).","met":true},"exploitation":{"de":"Die Angriffe trafen 2.773 Organisationen, direkt oder über einen Dienstleister, der MOVEit nutzte (Emsisoft, 28. Juni 2024).","en":"The attacks hit 2,773 organizations, directly or through a service provider that used MOVEit (Emsisoft, June 28, 2024).","met":true},"reach":{"de":"Rund 2.500 MOVEit-Transfer-Server waren aus dem Internet erreichbar, weit unter 100.000 (Rapid7, 31. Mai 2023).","en":"Roughly 2,500 MOVEit Transfer servers were reachable from the internet, far below 100,000 (Rapid7, May 31, 2023).","met":false},"response":{"de":"Eine gemeinsame Warnung von CISA und FBI und ein Eintrag in der CISA-Liste ausgenutzter Schwachstellen, aber weder eine Notfallanweisung noch die höchste nationale Warnstufe sind dokumentiert (CISA, Juni 2023).","en":"A joint warning from CISA and the FBI and an entry on CISA's list of exploited vulnerabilities, but no emergency directive or highest national warning level is documented (CISA, June 2023).","met":false}},"cves":["CVE-2023-34362","CVE-2023-35036","CVE-2023-35708"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-89","dates":[{"date":"2023-05-27","key":"exploited"},{"date":"2023-05-31","de":"Progress warnt seine Kunden und veröffentlicht korrigierte Versionen","en":"Progress warns its customers and releases fixed versions"},{"date":"2023-06-06","de":"Cl0p bekennt sich auf seiner Leak-Seite zu den Angriffen","en":"Cl0p claims the attacks on its leak site"},{"date":"2023-06-07","de":"CISA und FBI veröffentlichen eine gemeinsame Warnung","en":"CISA and the FBI publish a joint warning"},{"date":"2023-06-09","de":"Fix für eine zweite Lücke, gefunden bei einer Code-Prüfung","en":"Fix for a second flaw, found in a code review"},{"date":"2023-07-06","de":"Ein Service Pack schließt drei weitere Lücken","en":"A service pack closes three more flaws"}],"de":{"credit":"Kein Entdecker genannt: Die Lücke kam durch die Angriffe ans Licht","fixed":"MOVEit Transfer 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 und 2023.0.1 (31. Mai 2023); weitere Fixes im Juni und Juli 2023","product":"Progress MOVEit Transfer, ein Server für den Dateiaustausch mit Partnern","summary":"Die Bande Cl0p nutzte eine unbekannte Lücke im Dateiserver MOVEit Transfer, um Daten von 2.773 Organisationen zu stehlen."},"disclosed":"2023-05-31","en":{"credit":"No finder named: the flaw came to light through the attacks","fixed":"MOVEit Transfer 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 and 2023.0.1 (May 31, 2023); more fixes in June and July 2023","product":"Progress MOVEit Transfer, a server for exchanging files with partners","summary":"The Cl0p gang used an unknown flaw in the MOVEit Transfer file server to steal data from 2,773 organizations."},"figures":[{"de":"Millionen Menschen, deren Daten betroffen waren, laut Meldungen von Datenpannen (Emsisoft)","en":"million people whose data was affected, according to breach notices (Emsisoft)","value":"95.8"},{"de":"Organisationen getroffen, direkt oder über einen Dienstleister (Emsisoft)","en":"organizations hit, directly or through a service provider (Emsisoft)","value":"2,773"},{"de":"Tage lang liefen Angriffe, bevor es einen Fix gab","en":"days of attacks before a fix was out","value":"4"},{"de":"MOVEit-Transfer-Server waren aus dem Internet erreichbar (ungefähr; Rapid7, 31. Mai 2023)","en":"MOVEit Transfer servers reachable from the internet (roughly; Rapid7, May 31, 2023)","value":"2,500"}],"kev":"2023-06-02","key":"moveit","name":"MOVEit Transfer","product":"Progress MOVEit Transfer","sources":[{"de":"CVE-Eintrag CVE-2023-34362, mit den betroffenen Versionen","title":"CVE record CVE-2023-34362, with the affected versions","url":"https://www.cve.org/CVERecord?id=CVE-2023-34362"},{"de":"NVD: CVE-2023-34362","title":"NVD: CVE-2023-34362","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362"},{"de":"CISA und FBI: gemeinsame Warnung zu Cl0p und MOVEit (7. Juni 2023)","title":"CISA and FBI: joint advisory on Cl0p and MOVEit (June 7, 2023)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a"},{"de":"Mandiant: Zero-Day in MOVEit Transfer für Datendiebstahl genutzt","title":"Mandiant: zero-day in MOVEit Transfer used for data theft","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft"},{"de":"Rapid7: Ausnutzung der Lücke in MOVEit Transfer, mit Nachträgen bis August 2023","title":"Rapid7: exploitation of the MOVEit Transfer flaw, updated to August 2023","url":"https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"},{"de":"Emsisoft: Statistik zum MOVEit-Datenleck, letzter Stand 28. Juni 2024","title":"Emsisoft: MOVEit breach statistics, last count June 28, 2024","url":"https://emsisoft.com/en/blog/44123/unpacking-the-moveit-breach-statistics-and-analysis/"},{"de":"SecurityWeek (Presse): Emsisofts Zählung vom 24. August 2023","title":"SecurityWeek (press): Emsisoft's count of August 24, 2023","url":"https://www.securityweek.com/nearly-1000-organizations-60-million-individuals-impacted-by-moveit-hack/"},{"de":"Help Net Security (Presse): mehr als 2.000 betroffene Organisationen, September 2023","title":"Help Net Security (press): more than 2,000 victim organizations, September 2023","url":"https://www.helpnetsecurity.com/2023/09/26/moveit-victim-number/"},{"de":"BleepingComputer (Presse): Krolls Hinweise auf Tests seit 2021","title":"BleepingComputer (press): Kroll's finding of tests since 2021","url":"https://www.bleepingcomputer.com/news/security/clop-ransomware-likely-testing-moveit-zero-day-since-2021/"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2023}},"description":"A flaw in the file transfer server MOVEit Transfer let the Cl0p gang steal data from 2,773 organizations. How it worked, who was hit, and what to do now.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"At the end of May 2023, the criminal group Cl0p began to steal files from MOVEit Transfer, a server that organizations use to exchange large files with partners. The group used a zero-day, a flaw that the maker did not know about yet, and stole data from hundreds of servers within days. By June 2024, 2,773 organizations and the data of 95.8 million people were known to be affected.\nHow it worked The flaw, CVE-2023-34362, is an SQL injection. MOVEit keeps its data in a database and talks to it in the database language SQL. With a crafted series of web requests to two normal parts of the application, an attacker who was not logged in could smuggle SQL commands into these requests. That let the attacker read and change the database and get the session of an administrator.\nThe attackers then installed a web shell, a small program that takes commands over the web, under the harmless-looking name human2.aspx. Security researchers call it LEMURLOOT. It listed the stored files, created accounts and downloaded data, also from linked cloud storage at Microsoft Azure. In some cases, the data was gone within minutes of the web shell being installed, the security company Mandiant found.\nAttackersends crafted web requests, no login SQL injectiondatabase commands slip into the requests Admin sessionthe attacker gets administrator rights Web shellinstalled as human2.aspx Data theftfiles downloaded, sometimes within minutes The attack in five steps, from the first web request to the stolen files. No password was needed at any point. Cl0p did not lock the systems, as ransomware gangs often do. It stole the data and then extorted the victims through its leak site, a website where it publishes stolen data. On June 6, 2023, the group claimed the attacks there. According to a press report on an analysis by the security company Kroll, the attackers may have been testing the flaw as early as July 2021.\nReach and damage The number of servers was small. The security company Rapid7 counted roughly 2,500 MOVEit Transfer servers reachable from the internet on May 31, 2023, most of them in the US. The damage came from what they held: files that organizations exchanged with their partners. Some victims were not hit directly, but through a service provider that used MOVEit.\nThe list of victims kept growing for more than a year, as organizations sent out breach notices. The security company Emsisoft collected them.\nKnown victims of the MOVEit attacks August 24, 2023988 September 25, 2023 (more than)2,000 June 28, 20242,773 Organizations, including those hit through a service provider. Count by Emsisoft; the first two values were reported by SecurityWeek and Help Net Security.\nThe number of people affected rose from roughly 59.2 million in August 2023 to 95,788,491 in Emsisoft\u0026rsquo;s last count of June 28, 2024. Some people may be counted twice, and the count was likely to rise further. The largest single case was Maximus, a contractor for US government services, with 11.3 million people, followed by Welltok with 10 million and Delta Dental of California with 6.9 million. Of the known victims, 78.9 % were based in the US.\nVictims by sector Education39.1 % Health20.1 % Finance and professional services13.3 % Share of the known victim organizations, Emsisoft, June 28, 2024.\nThe fix and the response Progress Software, the maker of MOVEit, published a warning and fixed versions on May 31, 2023, four days after the first attacks. It patched its cloud version the same day and told customers to check for signs of unauthorized access over at least the past 30 days. On June 2, the US cybersecurity agency CISA put the flaw on its list of exploited vulnerabilities. On June 7, CISA and the FBI published a joint warning about Cl0p.\nIt was not the group\u0026rsquo;s first attack on file transfer software. In early 2023, it had hit about 130 victims within ten days through another product, GoAnywhere MFT, CISA reported.\nCode reviews after the first fix turned up more SQL injection flaws in MOVEit Transfer. Progress fixed them on June 9 (CVE-2023-35036), June 15 (CVE-2023-35708) and July 6, 2023, when a service pack closed CVE-2023-36934 and two further flaws.\nThe scores are the same on all sides: the US National Vulnerability Database and CISA both rate the main flaw 9.8 of 10. The CVE record names no finder: the flaw came to light through the attacks, not through a report by researchers.","title":"MOVEit: the file transfer flaw that Cl0p used to steal data","url":"https://crackthe.net/vulnerabilities/moveit/"}