INCIDENT REPORT · CP-2023-003

MOVEit Transfer mass exploitation by Cl0p

L3 · ELEVATEDCONFIRMED

From 27 May 2023, the Cl0p ransomware gang exploited a zero-day SQL injection flaw in MOVEit Transfer managed file transfer software to steal data from organizations worldwide.

Incident ID: CP-2023-003
Incident date: 27 MAY 2023
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Burlington, United States (Vendor of the exploited product (Progress Software); victims were worldwide)
Threat classification: Level 3 — ELEVATED
Classification rationale: Mass data theft affecting thousands of organizations across sectors and countries; consequences were data exposure rather than disruption of essential services.
Attack type: Vulnerability Exploitation
Nature: Malicious activity
Attack vector: SQL injection zero-day in Progress MOVEit Transfer (CVE-2023-34362) used to install the LEMURLOOT web shell and steal data
Sectors: Government, Finance, Healthcare, Education, Technology
Critical infrastructure: No
Organizations affected: Progress Software (vendor), Organizations running internet-facing MOVEit Transfer
Operational consequences: Data was stolen en masse from MOVEit Transfer databases and used for extortion. CISA and the FBI issued joint advisory AA23-158A on 7 June 2023.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by CISA and the FBI to the CL0P ransomware gang (TA505)

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

MOVEit Transfer mass exploitation by Cl0p

L3 · ELEVATEDCONFIRMED

From 27 May 2023, the Cl0p ransomware gang exploited a zero-day SQL injection flaw in MOVEit Transfer managed file transfer software to steal data from organizations worldwide.

Incident ID

CP-2023-003

Incident date

27 MAY 2023

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Burlington, United States (Vendor of the exploited product (Progress Software); victims were worldwide)

Threat classification

Level 3 — ELEVATED

Classification rationale

Mass data theft affecting thousands of organizations across sectors and countries; consequences were data exposure rather than disruption of essential services.

Attack type

Vulnerability Exploitation

Nature

Malicious activity

Attack vector

SQL injection zero-day in Progress MOVEit Transfer (CVE-2023-34362) used to install the LEMURLOOT web shell and steal data

Sectors

Government, Finance, Healthcare, Education, Technology

Critical infrastructure

Organizations affected

Progress Software (vendor), Organizations running internet-facing MOVEit Transfer

Operational consequences

Data was stolen en masse from MOVEit Transfer databases and used for extortion. CISA and the FBI issued joint advisory AA23-158A on 7 June 2023.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by CISA and the FBI to the CL0P ransomware gang (TA505)