This webshell supports several parameters, triggering specific actions depending on the parameter used. Trustwave is diligently monitoring the situation for client exposure and associated attacks and will provide updates here as we have them.įigure 1: Shodan results based on service headersįigure 2: Shodan results based on favicon hashĪfter exploitation, the threat actor drops the file ' human2.aspx' on the system.

Although it equally suggests any of the other services that Progress Software offers). As of June 2 nd, Shodan searches for public facing MOVEit instances show over 500 systems that directly have MOVEit in the service headers and over 2,500 systems using the the MOVEit favicon (which suggests the system is using MOVEit even if the service headers provide don't show that. It is used by organizations to securely transfer files for business partners and customers.Īll MOVEit Transfer versions are affected by this vulnerability. Those of you that have been around IT for a stretch might remember Ipswitch's popular FTP software (WS_FTP). MOVEit Transfer is a managed file transfer (MFT) solution developed by Ipswitch (a subsidiary of Progress Software).

Resources links, including one for the patch, are at the bottom of this post. The vulnerability being exploited is an SQL injection and has since been patched. On May 31, threat actors were discovered targeting a critical zero day in MOVEit Transfer software resulting in escalated privileges and unauthorized data access.

Ftp mozilla