In 2023, nearly 900 colleges learned through National Student Clearinghouse — a nonprofit that processes enrollment and degree-verification data — that the MOVEit breach could involve their student records. Many affected schools did not operate or patch the compromised MOVEit instance themselves; it sat upstream in their service chain.

That cascade — one file-transfer server, hundreds of downstream organizations that may never have operated the vulnerable software — is not unique to MOVEit. Similar concentration risk has appeared repeatedly in incidents involving Accellion, GoAnywhere, MOVEit, and Cleo since 2020.

TL;DR

  • Managed File Transfer (MFT) software — enterprise tools built to move sensitive files between organizations in an auditable, controlled way — can create large downstream breaches because of how the category is deployed, not because any one vendor is uniquely careless.
  • Cl0p’s 2023 MOVEit Transfer campaign (CVE-2023-34362, SQL injection) is the largest confirmed case: Emsisoft tracked at least 2,618 affected organizations and 77+ million individuals as of late November 2023, based on public disclosures.
  • The same group had already run an almost identical campaign against Fortra’s GoAnywhere MFT two months earlier (CVE-2023-0669), and against Accellion’s File Transfer Appliance back in 2020–2021.
  • GoAnywhere got hit again in 2025 (CVE-2025-10035, Medusa ransomware) and Cleo’s MFT products got hit in December 2024 — this is not a closed chapter.
  • The fix isn’t “patch faster.” It’s reducing what’s exposed, segmenting the transfer tier, watching outbound data flows, and planning for the fact you may be a downstream victim before you even know your vendor was breached.

Why This Matters to You

If your organization exchanges files with banks, payroll processors, healthcare partners, government agencies, or law firms, an MFT tool may be somewhere in that chain — yours or a vendor’s. You don’t need to run MOVEit or GoAnywhere yourself to be exposed; you just need a partner who does. For blue teams and IT leadership, this category deserves the same standing agenda item as VPN gateways: attack surface that needs active management, not a “set it up once” checkbox.

Table of Contents

What Managed File Transfer Software Actually Does {#what-mft-does}

Managed File Transfer (MFT) is enterprise software built specifically to move files — often large, sensitive, or regulated ones — between organizations, with logging, access control, and automation layered on top of protocols like SFTP and FTPS. Think of it as a certified courier service between two companies’ computer systems, instead of someone emailing a spreadsheet as an attachment.

Banks use it to send payment files to processors. Universities use it to send enrollment data to clearinghouses. Hospitals use it to send records to insurers. Payroll vendors use it to move salary data between employers and benefits administrators. The whole point is that it carries the data companies care about protecting the most.

That’s exactly what makes it dangerous when it breaks.

Why MFT Products Are Structurally Attractive Targets {#why-structural}

1. It Sits at the Network Edge, By Necessity

An MFT server commonly has to be reachable from outside the organization — that’s the job. External partners, customers, and automated systems need to drop files onto it and pull files off it. Unlike an internal file share, it often answers requests from the public internet or from a wide set of external parties, although private connectivity and strict allowlists can reduce that exposure.

When the affected interface is internet-facing, authentication bypasses, vulnerable web components, and injection flaws may be reachable without a prior foothold — the same structural problem covered in Why Enterprise VPN and Gateway Products Are Perpetually Broken.

2. It Holds Third-Party Data by Design — Not Just Your Own

A compromised internal application typically exposes one organization’s data. A compromised MFT server exposes whatever files were sitting in its transfer queues — which, by design, includes data belonging to every partner, client, and vendor that used it in the recent past. The server is deliberately built to be a temporary (or not-so-temporary) warehouse for other people’s sensitive records.

This is structurally close to the dependency confusion and npm supply-chain problem: compromise one shared component, and the blast radius extends to everyone downstream of it — except here the “component” is a file server holding real records, not a code library.

3. A History of Weak Input Validation

The bug classes behind the biggest MFT breaches are not exotic. SQL injection (an attacker inserting malicious database commands through an unsanitized web form or API parameter) broke MOVEit Transfer. Insecure deserialization (an application trusting and reconstructing attacker-supplied serialized data without validating it, letting the attacker smuggle in commands) broke GoAnywhere MFT — twice. Unrestricted file upload broke Cleo’s products. These are decades-old vulnerability classes, covered in depth in SQL Injection 2026, still showing up in software regulated industries trust with their most sensitive files.

4. One Compromise, Every Downstream Customer

Because MFT tools route data on behalf of other organizations, a single vulnerable instance can expose dozens of unrelated companies that never chose that software and never got a vote in its patch cadence. National Student Clearinghouse’s MOVEit instance is the clean example: one server, one vulnerability, close to 900 downstream schools notified, according to reporting from Recorded Future News and Help Net Security. Progress notified NSC in late May 2023; NSC notified its member schools in late June, without full details because the investigation was still active — a disclosure lag that repeated itself down every branch of the vendor tree, including through Pension Benefit Information (PBI) and TIAA.

5. Attackers Have Learned It’s Repeatable

The same threat cluster — tracked by different vendors as TA505, FIN11, Lace Tempest, and Gold Tahoe, closely tied to the Cl0p extortion brand — has run this exact playbook against four MFT product lines since 2020: Accellion FTA, GoAnywhere MFT, MOVEit Transfer, and Cleo’s LexiCom/VLTrader/Harmony suite. When a tactic keeps working, organized groups keep reusing it.

The Incident History {#incident-history}

ProductCVE(s)YearRoot CauseDisclosed Impact
Accellion FTACVE-2021-27101/27102/27103/271042020–2021Chained SQLi, OS command injection, SSRF (four zero-days)Fewer than 100 of ~300 FTA customers breached; fewer than 25 with significant data theft, per Accellion/CISA
Fortra GoAnywhere MFTCVE-2023-06692023Pre-auth insecure deserialization → command injectionCl0p claimed 130+ organizations on its leak site
Progress MOVEit TransferCVE-2023-34362 (+ CVE-2023-35036, CVE-2023-35708)2023Unauthenticated SQL injection → RCE2,618+ organizations, 77M+ individuals per Emsisoft (Nov 2023)
Cleo LexiCom/VLTrader/HarmonyCVE-2024-50623, CVE-2024-559562024Unrestricted file upload/download → RCE200+ victims posted to Cl0p’s leak site in December 2024
Fortra GoAnywhere MFTCVE-2025-100352025Forged license signature → deserialization → command injection (CVSS 10.0)Storm-1175 intrusions, Medusa ransomware deployed in at least one confirmed case
Progress MOVEit AutomationCVE-2026-4670, CVE-2026-51742026Authentication bypass via backend command port, chained privilege escalation (CVSS 9.8)Reported privately by Airbus SecLab researchers; patched before confirmed mass exploitation

Six major incidents, four product lines, six years. This is a category-level pattern, not a one-vendor problem.

Deep Dive: Cl0p’s MOVEit Transfer Campaign {#moveit-deep-dive}

The largest of these events by disclosed scale is worth walking through in detail.

The vulnerability. CVE-2023-34362 is a SQL injection flaw in Progress Software’s MOVEit Transfer that lets an unauthenticated attacker query and manipulate the underlying database, leading to remote code execution. NVD scores it 9.8 out of 10 on CVSS (Common Vulnerability Scoring System) — network-exploitable, no authentication needed, full compromise of confidentiality, integrity, and availability.

The timeline. Fastly observed the earliest SQL injection probing against MOVEit endpoints on May 9, 2023. Cl0p began mass exploitation around May 27, per Rapid7’s incident timeline. Progress started warning customers on May 31; the CVE was assigned June 2. CISA and the FBI published a joint advisory, AA23-158A, on June 7. Two more MOVEit flaws, CVE-2023-35036 and CVE-2023-35708, were found and patched over the following two weeks as Progress’s own investigation turned up further issues in the same code.

The mechanism. Attackers deployed a custom web shell — a malicious script giving persistent command access on a compromised server — named LEMURLOOT, disguised inside MOVEit Transfer’s own web application. LEMURLOOT let Cl0p query the MOVEit database directly and pull whatever files were queued for transfer, with no need for standing access afterward.

Attribution. Microsoft attributed the campaign to a Cl0p affiliate it tracks as Lace Tempest (Storm-0950), linked to the longer-running FIN11 and TA505 clusters and to Evil Corp. Mandiant tracks the same activity as UNC4857, also assessed as connected to FIN11 — different vendor names for the same actor with a long history of hitting file-transfer software specifically.

The scale — and why the number keeps moving. Early tallies were necessarily incomplete, because notifications cascade slowly through vendor chains. By late November 2023, Emsisoft — tracking public breach disclosures as they arrived — put the count at 2,618 confirmed organizations and more than 77 million individuals, per BankInfoSecurity. This is a running total built from public disclosures rather than a single official figure, and should be cited with its source and date rather than treated as fixed. Named organizations included the BBC, British Airways, Shell, two U.S. Department of Energy entities, Johns Hopkins University, the University of Georgia, the government of Nova Scotia, and state agencies in Illinois, Oregon, and Louisiana, per Cybersecurity Insiders. The Minnesota Department of Education separately disclosed 95,000 affected students.

Deep Dive: GoAnywhere MFT, Twice {#goanywhere-deep-dive}

2023. Two months before MOVEit, the same actor cluster ran an almost identical operation against Fortra’s GoAnywhere MFT. CVE-2023-0669 is a pre-authentication command injection flaw (CVSS 7.2) in GoAnywhere’s License Response Servlet, caused by the application deserializing an attacker-controlled object without validating it first — CWE-502, insecure deserialization. Customer telemetry pointed to exploitation as early as January 18, 2023; Fortra learned of suspicious activity on January 30 and shipped a fix (version 7.1.2) on February 7. A public exploit appeared February 6, and on February 10 Cl0p told BleepingComputer it had already breached 130+ organizations, including Procter & Gamble, Hitachi Energy, and the City of Toronto. Cl0p also claimed it could have deployed ransomware payloads on victim networks but chose not to — it only exfiltrated documents from the GoAnywhere servers themselves.

2025. GoAnywhere was hit again. CVE-2025-10035, disclosed by Fortra on September 18, 2025, is a maximum-severity (CVSS 10.0) flaw in the same License Servlet component: a forged license response signature forces deserialization of arbitrary objects, leading to command injection. Microsoft attributed active exploitation to a cluster it tracks as Storm-1175, which deploys Medusa ransomware, with related intrusion activity dating to September 11 — a week before public disclosure, meaning at least some victims were hit as a genuine zero-day. The observed chain used .jsp web shells in MFT directories, remote monitoring tooling for persistence, RDP for lateral movement, Cloudflare tunnels for command-and-control, and rclone for bulk exfiltration, with at least one confirmed Medusa deployment. Fortra patched in version 7.8.4 and a 7.6.3 sustained release.

Same license/deserialization subsystem, over six years apart, hit by two affiliated actor sets using the same fundamental technique.

The Extortion Model: Why No Encryption Doesn’t Mean No Damage {#extortion-model}

Cl0p’s MFT campaigns broke from the classic ransomware script: in most incidents, victim systems were never encrypted. Instead, Cl0p exfiltrated data quietly, then posted victim names to its leak site with a payment deadline — MOVEit victims were given until June 14, 2023 to make contact before being named, per CISA’s advisory. This “steal and shame” approach is covered in more depth in Ransomware Doesn’t Need to Encrypt Anymore; MOVEit and GoAnywhere effectively proved the model at scale.

The absence of encryption doesn’t reduce the damage; it just changes its shape. There’s no crippled hospital or halted factory line to force urgent attention. Instead there’s a slow-burning, months-long disclosure process as regulatory obligations, contractual notifications, and journalist inquiries surface one downstream victim at a time — the defining feature of these events being that many victims don’t know they’re victims for weeks, because the compromise happened at a vendor’s vendor, not at their own network edge. That is a supply-chain problem in every meaningful sense, similar in shape to the blast radius covered in dependency confusion attacks — except the compromised dependency is a file server holding real people’s records instead of a software package.

Defending the MFT Tier {#defending}

Reduce What’s Exposed

The highest-leverage change is also the simplest: the MFT product’s administrative interface should never be directly reachable from the public internet. Exploitation of both MOVEit and GoAnywhere relied on hitting web endpoints that many organizations had unnecessarily exposed. Put the admin console behind a VPN or bastion host; only the file-transfer endpoints partners actually need should face outward, sitting behind a reverse proxy that can be updated independently of the MFT vendor’s own patch cycle.

Treat Virtual Patching and WAF Rules as a Bridge, Not a Fix

A Web Application Firewall (WAF) — a filter that inspects and blocks malicious HTTP requests before they reach the application — can block known exploit patterns within hours of a public advisory, well before formal change management completes a vendor patch. This buys time; it doesn’t replace patching. Several of these vulnerabilities were zero-days with no available signature at the time of first exploitation, so it’s a mitigation for the second wave, not the first.

Segment the File-Transfer Tier Like It’s Hostile

An MFT server shouldn’t have broad access to the rest of the internal environment — only outbound paths to the specific systems it legitimately talks to. If it’s compromised, segmentation determines whether the incident stays contained to “files that were on this box” or expands into a full internal foothold.

Monitor for Anomalous Outbound Data Flows

Because these campaigns are exfiltration-first rather than encryption-first, the most useful signal is often network-based: large or unusual outbound transfers, especially to unfamiliar cloud storage endpoints or via tools like rclone. CISA’s MOVEit advisory specifically flagged suspicious HTTP POST requests to MOVEit-specific endpoints and unusual folder-upload API calls as detection indicators — telemetry that only gets caught if someone is watching MFT logs and egress, not just uptime.

Plan for the “Are We a Victim Yet?” Problem

Your incident response playbook should explicitly cover the scenario where a vendor’s vendor discloses an MFT breach before you know whether your data passed through it. Maintain a current inventory of every third party that receives your data via file transfer, with a defined process to quickly ask each one whether they used the affected product. Waiting for a notification letter, as many NSC-affiliated schools effectively did, costs weeks of response time you don’t get back.

What You Can Do Today {#what-you-can-do}

  1. Inventory every MFT product in your environment and every vendor who moves your data through one of theirs.
  2. Pull the admin interface off the public internet for any MFT product you operate directly.
  3. Subscribe to the vendor’s security advisories directly (Progress, Fortra, and equivalents) rather than relying on general news coverage.
  4. Add relevant CVEs to your CISA KEV monitoring the moment they’re published — Cl0p’s campaigns move from disclosure to mass exploitation in days.
  5. Check your egress logs from any MFT server for large or unusual outbound transfers, right now, not just after an advisory drops.
  6. Draft (or update) a third-party notification playbook that assumes you may be a downstream victim of a breach you have no direct visibility into.

None of these require a large budget. All of them reduce how long you stay blind if the next MFT zero-day lands on a product you or your partners depend on.

Sources