by Ori David, Sam Tinklenberg, Maxim Zavodchik, and Ophir Harpaz

\r\n Executive summary

\r\n \r\n On May 31, 2023, Progress Software began warning customers of a previously unknown vulnerability in MOVEit Transfer and MOVEit Cloud software. The SQL injection (SQLi) vulnerability, assigned CVE-2023-34362, has been actively exploited by attackers.

\r\n

\r\n According to a report by Mandiant, exploitation attempts of this vulnerability were detected as early as May 27, 2023. On the same day, Akamai researchers detected exploitation attempts against one of Akamai’s financial customers — an attack that was blocked by the Akamai Adaptive Security Engine.

\r\n

\r\n The attack campaign was attributed to a ransomware group dubbed CL0P.  The group, thought to be based in Russia or Eastern Europe , is financially motivated and has been known to extort their victims via data exfiltration.

\r\n

\r\n Attackers have exploited the SQLi vulnerability to deploy a custom ASP.NET web shell (LEMURLOOT) to achieve…