Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

MOVEit Transfer (CVE-2023-34362) → mass data exfil (Cl0p)

Pre-auth SQLi in MOVEit's web UI forges an admin session. .NET deserialisation chain drops a webshell as SYSTEM. Cl0p's 2023 mass-exfil playbook: download every file under /var/files.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target uses Progress MOVEit Transfer, internet-exposed, unpatched for CVE-2023-34362. MOVEit holds sensitive customer / employee files (its main use case).

§ Steps

  1. 01
    Download every file in storageExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Leak-site ransom noteImpact
    T1486— Data Encrypted for Impact
  3. 03
    .NET deserialisation chain → SYSTEMExecution
    W-DESER-NET— Deserialization — .NET BinaryFormatter / JSON.NET
  4. 04
    Identify MOVEit by HTTP headersReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  5. 05
    Webshell on the appliancePersistence
    W-WEBSHELL— Webshell Deployment
  6. 06
    SQLi in /human.aspx → admin sessionInitial Access
    CVE-MOVEIT— MOVEit Transfer SQLi → Deserialisation (CVE-2023-34362)

§ References

§ Frequently asked

What is the "MOVEit Transfer (CVE-2023-34362) → mass data exfil (Cl0p)" attack path?
Pre-auth SQLi in MOVEit's web UI forges an admin session. .NET deserialisation chain drops a webshell as SYSTEM. Cl0p's 2023 mass-exfil playbook: download every file under /var/files. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Download every file in storage (T1041) — a exfiltration primitive. Assumed environment: target uses Progress MOVEit Transfer, internet-exposed, unpatched for CVE-2023-34362.
What is the final impact of this kill-chain?
The final step lands on SQLi in /human.aspx → admin session (CVE-MOVEIT), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers