MOVEit Transfer Vulnerability

A critical SQL-injection vulnerability in Progress MOVEit Transfer (CVE-2023-34362) is being actively exploited in the wild, with observers linking attacks and large-scale data theft to threat actors including the Clop ransomware group; attackers have deployed web-shell backdoors (commonly at /human2.asp(x) that check a specific X-siLock-Comment header) and Censys/Greynoise telemetry indicates thousands of MOVEit instances (predominantly in the U.S. and across finance, healthcare, and government) are exposed and possibly compromised.