Case study: one appliance, and the disclosure that followed
CL0P against MOVEit Transfer, worked as a case rather than read as news. A zero-day in an internet-facing file transfer product, a web shell, and a scope question that has nothing to do with how many hosts were touched. Nine questions, and the answers are in the advisory.
This is a real incident, worked as a case. Everything factual below comes from
the joint advisory the FBI and CISA published about it, linked at the end, and
nothing has been added to make it tidier.
The questions are the point. Work them before reading on, and where a question
asks what you would do, the useful version of the answer is the one you could
hand to somebody else.
What happened
Progress MOVEit Transfer is a managed file transfer product. Organisations put
it on the internet deliberately, because its job is to move files between them
and people outside. It holds a database of transfers and, frequently, the files
themselves.
