Huntress Says MOVEit Victim Disclosures May Reflect Delayed Cl0p Follow-Up

Summary

Huntress observed no significant MOVEit exploitation after late May 2023; later victim disclosures may reflect delayed cl0p follow-up to earlier compromises. It urges defenders to retain telemetry, monitor data flows and hunt for lingering access.

Key points

Huntress telemetry and industry-partner discussions showed no significant MOVEit exploitation after late May 2023, despite later victim disclosures.
Huntress linked the exploitation to cl0p and said observed activity involved deploying a web shell to copy and exfiltrate files.
Huntress reported no publicly known cases of the attackers using this access to break into broader victim networks or deploy network-wide ransomware.
The web shell was largely consistent across victims, with superficial filename changes and a seemingly randomly generated hardcoded password.
Huntress hypothesized that widespread exploitation may have overwhelmed operators, leaving them to pursue delayed data theft and extortion; it said evidence was insufficient to prove this explanation.
The article advises defenders to monitor anomalous data flows, retain host and network telemetry, and hunt for signs of earlier or lingering compromise.
It also recommends maintaining coverage for legacy vulnerabilities and techniques, which may remain useful to attackers or reemerge.