Lesson 2.9: Mass exploitation: the MOVEit Transfer campaign
In late May 2023 the Cl0p extortion group used a zero-day SQL injection in Progress MOVEit Transfer (CVE-2023-34362) against thousands of organisations at once: it planted a web shell named human2.aspx, created an account, and downloaded the files the servers were meant to protect, then demanded payment not to publish them. No ransomware was needed. CISA and the FBI published the indicators (advisory AA23-158A). During Northwind's integration of Brightwater, an old MOVEit server's logs from those days turn up. In the lab you check them for the published indicators and measure what left.
17 min
You will learn to
- Explain mass exploitation and data-theft extortion
- Hunt for published indicators in IIS logs
- Reconstruct an attack sequence
- Find planted files and rogue accounts
- Estimate data exfiltration from logs
Key terms
- Mass exploitation
- Automated exploitation of one vulnerability against every reachable instance.
- Data-theft extortion
- Stealing data and threatening to publish it, without encrypting anything.
- Indicator of compromise
- Published evidence of an attack: file names, accounts, paths, addresses.
- W3C extended log
- IIS's log format; the #Fields line names each column.
- Breach notification
- Legal duty to report personal-data breaches to authorities and people affected.
← Signing software releases · All lessons · Assets, threats, vulnerabilities and risk →