MOVEit Transfer's CVE-2023-34362 was a SQL injection zero-day that the CL0P group used to install a web shell called LEMURLOOT and steal data from the underlying database. CISA's advisory lists specific things to hunt for: a file named human2.aspx, a particular header, and accounts named Health Check Service.
What happened, in brief
CISA's advisory AA23-158A says CL0P, also tracked as TA505, exploited CVE-2023-34362 in internet facing MOVEit Transfer web applications. Per open-source reporting cited there, exploitation began on 27 May 2023. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2 June and released the advisory on 7 June.
Affected versions included 2023.0.0 and the 2022, 2021 and 2020 release lines listed in the advisory. The same actor had earlier run zero-day campaigns against Accellion File Transfer Appliance devices and Fortra GoAnywhere MFT, which suggests a pattern: managed file transfer products are attractive because they hold other people's data by design.
The checks, one at a time
- Look for the web shell file. The advisory points to
human2.aspx, which masquerades as the legitimatehuman.aspx. - Search web logs for the header. The shell used an
X-siLock-CommentHTTP header for authentication. - Search for rogue accounts. The shell created and deleted accounts named or displayed as Health Check Service.
- Audit administrators in the MOVEit database. Confirm that every active admin account is one you expect.
- Run the published YARA rules and compare hashes and addresses against the advisory's indicator tables.
The catch about rebuilds
The advisory warns that if you rebuild a web server but keep the same database, the actor's accounts can persist. Reimaging a server is not enough on its own. Audit the database as well, and rotate credentials that the application could read.
Hardening steps CISA lists
- Prioritise known exploited vulnerabilities on internet facing systems.
- Inventory assets and allowlist approved applications.
- Restrict administrator privileges and audit admin accounts.
- Apply phishing resistant multifactor authentication to remote access and critical services.
- Segment networks and monitor for lateral movement.
- Keep encrypted, immutable, offline backups and test restores.
Why zero-days change the playbook
With a zero-day there is no patch on day one, so inventory and exposure management do the work. Know which internet facing products you run, who owns them, and how fast you can take one offline. After a patch ships, check whether you were already compromised before you applied it, because exploitation started before the advisory existed.
Click through it at your own pace, or open it full screen.
Safeguard's zero-day discovery and asset discovery features are aimed at exactly this gap, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Is a clean rebuild of the MOVEit server enough?
Not by itself. CISA notes the attacker's accounts can persist in the database if you keep it, so audit the database too.
Who did CISA attribute the campaign to?
The CL0P ransomware gang, also known as TA505.
Sources
Last reviewed: 19 October 2026.
