Summary:
Following the discovery of a zero-day vulnerability within the MOVEit cloud platform (and on-premise versions), we shut down portions of the cloud service out of an abundance of caution while we worked to develop and deploy a patch. The cloud service has been restored to operation following patching and the investigation remains ongoing. 

The information contained in this document is based on best available knowledge as of 9am Eastern Time on June 2, 2023 and may change.

Timeline:
Based on our current and ongoing investigation, the MOVEit technical support team received initial customer calls indicating suspicious activity on May 28, 2023.  

Upon discovery of the exploit in some of our cloud clusters, we took the impacted services down on May 30, 2023 and continued to investigate the situation.

Following patching aimed at addressing the vulnerability, review of Indicators of Compromise (IoC), and the addition of currently known malicious IP addresses to our block lists, we restored service of the impacted cloud services on May 31, 2023.

The investigation remains ongoing and we will notify our customers if and when further mitigation measures become available.

What steps have been taken by Progress / MOVEit to investigate and remediate this incident?
Promptly following discovery and escalation of the vulnerability, the engineering team took down HTTP and HTTPs traffic to MOVEit Cloud and notified MOVEit Transfer customers to do the same in their own environments, while the team developed the appropriate patches for MOVEit Cloud, as well as the currently supported on-prem versions of MOVEit Transfer.  Progress thoroughly tested these patches before publishing and releasing them to production on May 31, 2023.

Progress also took the following steps aimed at increasing security monitoring and defending against further exploitation or attack:

• The Security team developed specific monitoring signatures on Progress’ end point protection system and alerted our 24x7x365 Security Operation Center.
• The Security team validated with engineering that the newly developed patch corrected the vulnerability.
• All new detection rules were tested before finalizing aimed at assuring that notifications are working properly
• Progress has engaged outside cybersecurity experts and other incident response professionals to conduct a forensic investigation and assess the extent and scope of the incident

Have we confirmed malicious activity on the Cloud service?
We identified the staged exploit on three of our clusters and removed it. We have not found any evidence that the exploit was activated or used by malicious parties to exfiltrate data from Cloud services, although the investigation remains ongoing. We continue to review access logs and systems logging, together with our systems protection software logs.

Do we have evidence of information exfiltrated for cloud customers?
As of now, we have no evidence of unauthorized data exfiltration of our cloud customers. 

Are there any indicators that allude to the presence of webshell(s)?
While we located the staged exploit on three of our clusters, we have not found any evidence that the exploit was activated or used by malicious parties to exfiltrate data from our Cloud services at this point. The patch allowed us to remove the exploit from the MOVEit environment and strengthen the applicable defenses in order to further alert us should attempts be made to re-install an exploit of similar nature.

What logs exist, and can we please obtain them?
We encourage customers to review their audit logs for signs of unexpected or unusual file downloads, particularly to those IP addresses listed in our previously shared knowledge base article here: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023

Here is more information on how to view log files:  https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2023/page/Logs.html Note that this list of IP addresses may grow as the investigation remains ongoing and we continue to monitor for attempts to exploit the now patched zero-day vulnerability.  Please continue to monitor this list for additional addresses. We have added those addresses to the firewall block lists of the cloud service and will continue to do so as we learn more.

The exploit would log file access and therefore if you see no unexplained downloads, it is highly likely that your cloud service has not been impacted.

Were all of the clusters impacted?
No. Investigations indicate that the following clusters had NO evidence of the staged exploit:

• US Clusters: C1, C2, C3
• Australia
• UK

You can determine which cluster you are on by reviewing:
https://community.progress.com/s/article/which-moveit-cloud-cluster-am-i-on

We encourage customers on the other clusters to review the past 30 days of audit logs as per the guidance above.