MOVEit Transfer Vulnerability Actively Exploited

The report documents active exploitation of a critical SQL injection flaw in MOVEit Transfer observed by Cyble Global Sensor Intelligence: attackers uploaded a human2.aspx webshell that authenticates via headers, executes SQL queries to enumerate and exfiltrate files and institutions, and can create or delete a 'Health Check Service' administrative account. The advisory includes technical code-level behavior, multiple SHA256 hashes and attacker IP/CIDR indicators, evidence of scanning and C2 infrastructure, and mitigation recommendations (patching, removing webshells, account resets, logging and segmentation).