Loading story…
Progress Software released a security bulletin for a critical MOVEit Transfer vulnerability, CVE-2024-5806, warning that a threat actor could exploit the flaw to take control of affected systems. CISA urged organizations to review Progress Software’s June 2024 alert and apply updates, while reporting indicated the bug was being attacked within hours of public disclosure, raising the risk of rapid compromise for internet-exposed file-transfer servers.
The new exploitation wave revived scrutiny of the earlier MOVEit crisis, when the Clop ransomware-linked extortion campaign compromised organizations across the private and public sectors. Reported victims and affected entities included technology and IT firms, state and federal agencies, schools tied to the Teachers Insurance and Annuity Association of America retirement fund, Norton LifeLock owner Gen Digital, Vancouver Transit Police, Missouri agencies, and Extreme Networks, underscoring how vulnerabilities in widely deployed managed file-transfer software can cascade into broad supply-chain and data-theft incidents.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Progress Software released a security bulletin for a critical MOVEit Transfer vulnerability tracked as CVE-2024-5806, warning that successful exploitation could let an attacker take control of an affected system. CISA advised users and administrators to review the June 2024 bulletin and apply updates.
Dark Reading reported that a newly disclosed MOVEit vulnerability was being exploited within hours of public disclosure, indicating rapid attacker activity against the flaw. This reflects active exploitation associated with the June 2024 MOVEit issue.
TechCrunch reported that schools said the teachers' retirement fund TIAA had been targeted by MOVEit hackers. This added a major financial-services-related victim affecting education stakeholders to the list of disclosed impacts.
CRN reported that eight technology and IT companies were targeted in the MOVEit attacks, underscoring the breadth of the victim set in the sector. The report reflected continued expansion of known affected organizations.
The Record reported that Norton LifeLock owner Gen Digital and Vancouver Transit Police confirmed breaches connected to the MOVEit vulnerabilities and attacks. These disclosures added both private-sector and public-sector victims to the incident timeline.
GovTech reported that more U.S. state and federal agencies were affected by the MOVEit compromise, showing the incident's spread into government organizations. The update indicated a widening impact beyond initially disclosed victims.
Computer Weekly reported that Extreme Networks had emerged as a victim of the Clop-linked MOVEit attacks. This marked one of the early named corporate victims publicly tied to the campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cisa.gov
Open sourcedarkreading.com
Open sourcegoogle.com
Open sourcecomputerweekly.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The list of organizations affected by the **MOVEit Transfer** breach continued to grow as reporting tied additional victims to the mass exploitation campaign against the managed file-transfer platform. The incident was widely linked to the **Clop** ransomware and extortion operation, which exploited a zero-day flaw in MOVEit to steal data from enterprises and institutions that used the software to exchange sensitive files. The expanding victim count underscored the broad downstream impact of third-party file-transfer compromises, with exposed data reportedly affecting banks, businesses, government entities, and other organizations connected to breached MOVEit deployments. The campaign highlighted how a single vulnerability in a widely used transfer product can rapidly become a large-scale supply-chain-style data theft event, forcing incident response, disclosure, and regulatory scrutiny across multiple sectors.
Jul 11, 2026
Progress Software disclosed and patched two vulnerabilities in **MOVEit Automation**, including **`CVE-2026-4670`**, a critical authentication-bypass flaw, and **`CVE-2026-5174`**, a high-severity privilege-escalation issue. The company warned that successful exploitation could let attackers access business data, gain administrative control, and expose sensitive information in the managed file transfer platform. Progress said customers must upgrade to the latest version using the **full installer** and shut down the software during the upgrade process to fully remediate the flaws. External exposure appears significant. Internet scanning cited by Cybersecurity Dive found more than **1,440** internet-connected systems running vulnerable MOVEit Automation versions, including **16** associated with state and local government agencies, while Censys separately issued an advisory tracking **`CVE-2026-4670`**. The disclosure drew added attention because MOVEit products have previously been targeted in high-impact exploitation campaigns, increasing concern that exposed and unpatched systems could become immediate targets.
Jun 29, 2026
The Cl0p extortion group exploited multiple critical SQL injection flaws in Progress Software's MOVEit Transfer platform, beginning with the zero-day later tracked as `CVE-2023-34362`, to breach organizations worldwide and steal large volumes of data. Researchers and government agencies linked the campaign to Cl0p, also tracked as Lace Tempest, `FIN11`, and `TA505`, and reported that attackers often deployed the **LemurLoot** web shell and exfiltrated files within minutes; in some cases, the malware could also pull Azure Blob storage details and credentials from MOVEit settings. Progress disclosed and patched additional MOVEit vulnerabilities, including `CVE-2023-35036` and `CVE-2023-35708`, as incident responders warned that victim counts would continue to rise through delayed breach notifications and downstream third-party exposure. The fallout spread across government, finance, healthcare, education, insurance, professional services, and major global brands, with disclosures naming entities such as EY, PwC, Sony and Pan-American Life Insurance Group among the affected organizations or reported victims. By later tallies, the campaign had compromised thousands of organizations and tens of millions of individuals, while Cl0p shifted from encryption to **data-theft and extortion**, publishing stolen information from nonpaying victims on leak sites. The incident triggered broad regulatory scrutiny, lawsuits, response costs, and supply-chain consequences as organizations discovered that exposure often came through vendors and file-transfer partners rather than direct compromise.
Jul 2, 2026