Could you have caught MOVEit? Ask whether you knew where file transfer servers ran, whether you heard about the flaw quickly, whether you could hunt for web shells and unexpected admin accounts, and whether you would notice large outbound transfers. CISA's advisory gives a clear set of controls to measure yourself against.
What does CISA say happened?
CISA advisory AA23-158A describes the CL0P group exploiting a SQL injection vulnerability, CVE-2023-34362, in Progress Software's MOVEit Transfer. Per open source reporting cited by CISA, exploitation began on 27 May 2023. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2 June 2023 and published the advisory on 7 June 2023.
The attackers installed a web shell, named LEMURLOOT by the advisory, on internet facing servers. It was used for persistence, information gathering and data theft from MOVEit databases. CISA describes capabilities such as retrieving Azure storage settings, enumerating the SQL database, and creating or deleting administrator accounts named "Health Check Service."
The advisory also notes earlier activity by the same group against other file transfer products, including a zero day in GoAnywhere MFT in late January 2023, which tells us this software category was a repeated target.
Why does this make a good self test?
Because the attack hit the places many teams are thin: a business critical server facing the internet, owned by a team outside security, holding sensitive data that others uploaded. Nothing here is about carelessness. File transfer systems tend to sit between departments.
The checklist
1. Do you know where file transfer lives? List every managed file transfer and similar service, including ones a business unit stood up. CISA's first recommended step is to inventory assets and data.
2. Is each one exposed to the internet on purpose? If a service must be reachable, restrict it by source where you can. Block remote access ports at the perimeter, as the advisory suggests.
3. How fast do you hear and act? CISA advises prioritizing patching for KEV entries on internet facing systems. Measure the hours between a vendor advisory and a decision.
4. Can you hunt for web shells? CISA provides YARA rules and file hashes. Do you have a way to run them across servers and look at web directories for unexpected files?
5. Do you audit admin accounts? The advisory suggests a SQL query to audit active administrative accounts after a rebuild, because accounts created by the attacker can survive if the database is kept. Who would run it, and where would the result go?
6. Can you see data leaving? Does network monitoring flag unusual volumes from a file transfer server to unfamiliar destinations?
7. Are least privilege and segmentation in place? What can the web server's service account reach? Can it talk to cloud storage with broad keys?
8. Do you keep data you no longer need? Files left on a transfer server past their purpose widen the impact. Set an expiry for transferred files.
9. Are backups safe? The advisory recommends encrypted, immutable, offline backups.
10. Do you know whom to call? CISA advises reporting incidents to the local FBI field office, IC3 or CISA. Keep contacts in your response plan, and note the advisory says ransom payment is not encouraged.
How to score yourself
Mark each item yes, partly or no. Any "no" on items 1, 4 or 5 is a priority, since they decide how fast you learn you were affected. Then add one action per gap with an owner and a date.
What to do this month
- Build the file transfer inventory.
- Put the vendor's advisory feed and the KEV catalog in front of someone who reads them daily.
- Write a runbook for emergency isolation of a transfer server.
- Test running a YARA scan on a staging server.
- Add an alert on large outbound transfers from these hosts.
- Set a retention limit on stored files.
Where do software inventories help?
When a flaw lands in a product you run, the first question is "where is it?". An accurate inventory of software, and for what you build, of dependencies, shortens that step. Safeguard generates SBOMs and scans dependencies in the CLI and web app. It does not detect web shells on servers, so pair it with endpoint and network tooling for that part.
Quick check
Was MOVEit exploited before a patch existed?
CISA's advisory describes it as exploitation of a zero day by CL0P, based on open source reporting, starting around 27 May 2023.
Is patching enough after a flaw like this?
Not alone. CISA advises hunting for web shells and auditing admin accounts, because an attacker may have persisted before the patch.
Sources
- CISA advisory AA23-158A: CL0P exploitation of MOVEit Transfer
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
