Move It on Over: Reflecting on the MOVEit Exploitation

**Executive Summary:** In late May 2023 the Cl0p group exploited a zero-day in MOVEit Transfer (CVE-2023-34362) to deploy web shells and exfiltrate data from many victims; initial exploitation was concentrated in a brief burst with a prolonged, slow monetization phase (leak site disclosures) representing a long-tail campaign. The report highlights that attackers prioritized data theft/extortion over lateral breakout and ransomware, discusses possible resource constraints limiting follow-up exploitation, and provides guidance for defenders on visibility, retention, patching, and active hunting.