# MA-944.062023: MyCERT Advisory - CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability

**Date:** 15 Jun 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-944.062023  
**Advisory ID:** MA-944.062023

---

**1.0 Introduction**
Open-source data indicates that on May 27, 2023, the CL0P Ransomware Gang, also known as TA505, started exploiting a previously unreported SQL injection vulnerability (CVE-2023-34362) in Progress Software’s managed file transfer (MFT), MOVEit Transfer.
A web shell called LEMURLOOT was used to infect MOVEit Transfer web apps that were accessible to the public and steal data from the underlying MOVEit Transfer databases. Similar flurry of activity was launched by TA505 in early 2023 targeting Fortra/Linoma GoAnywhere MFT servers and Accellion File Transfer Appliance (FTA) devices in the form of zero-day exploit-driven attacks.
**2.0 Impact**
- Retrieve Microsoft Azure system settings and enumerate the underlying SQL database.
- Store a string sent by the operator and then retrieve a file with a name matching the string from the MOVEit Transfer system.
- Create a new administrator privileged account with a randomly generated username and LoginName and RealName values set to “Health Check Service.”
- Delete an account with LoginName and RealName values set to ‘Health Check Service.’
**3.0 Affected Products**
- MOVEit Transfer 2023.0.0
- MOVEit Transfer 2022.1.x
- MOVEit Transfer 2022.0.x
- MOVEit Transfer 2021.1.x
- MOVEit Transfer 2021.0.x
- MOVEit Transfer 2020.1.x
- MOVEit Transfer 2020.0.x
**4.0 Indicators of Compromise (IoCs)4.1 Moveit Campaign Indicators of Compromised**
|  |  | --- | --- | --- | --- | **Files** | **Hash** | | LEMURLOOT  Web Shell  e.g. human2.aspx | 0b3220b11698b1436d1d866ac07cc90018e59884e91a8cb71ef8924309f1e0e9 |
| 0ea05169d111415903a1098110c34cdbbd390c23016cd4e179dd9ef507104495 |
| 110e301d3b5019177728010202c8096824829c0b11bb0dc0bff55547ead18286 |
| 1826268249e1ea58275328102a5a8d158d36b4fd312009e4a2526f0bfbc30de2 |
| 2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5 |
| 2ccf7e42afd3f6bf845865c74b2e01e2046e541bb633d037b05bd1cdb296fa59 |
| 348e435196dd795e1ec31169bd111c7ec964e5a6ab525a562b17f10de0ab031d |
| 387cee566aedbafa8c114ed1c6b98d8b9b65e9f178cf2f6ae2f5ac441082747a |
| 38e69f4a6d2e81f28ed2dc6df0daf31e73ea365bd2cfc90ebc31441404cca264 |
| 3a977446ed70b02864ef8cfa3135d8b134c93ef868a4cc0aa5d3c2a74545725b |
| 3ab73ea9aebf271e5f3ed701286701d0be688bf7ad4fb276cb4fbe35c8af8409 |
| 3c0dbda8a5500367c22ca224919bfc87d725d890756222c8066933286f26494c |
| 4359aead416b1b2df8ad9e53c497806403a2253b7e13c03317fc08ad3b0b95bf |
| 48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a |
| 58ccfb603cdc4d305fddd52b84ad3f58ff554f1af4d7ef164007cb8438976166 |
| 5b566de1aa4b2f79f579cdac6283b33e98fdc8c1cfa6211a787f8156848d67ff |
| 6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d |
| 702421bcee1785d93271d311f0203da34cc936317e299575b06503945a6ea1e0 |
| 769f77aace5eed4717c7d3142989b53bd5bac9297a6e11b2c588c3989b397e6b |
| 7c39499dd3b0b283b242f7b7996205a9b3cf8bd5c943ef6766992204d46ec5f1 |
| 93137272f3654d56b9ce63bec2e40dd816c82fb6bad9985bed477f17999a47db |
| 98a30c7251cf622bd4abce92ab527c3f233b817a57519c2dd2bf8e3d3ccb7db8 |
| 9d1723777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbace8ead |
| 9e89d9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348fdc24a |
| a1269294254e958e0e58fc0fe887ebbc4201d5c266557f09c3f37542bd6d53d7 |
| a8f6c1ccba662a908ef7b0cb3cc59c2d1c9e2cbbe1866937da81c4c616e68986 |
| b1c299a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2ec272 |
| b5ef11d04604c9145e4fe1bedaeb52f2c2345703d52115a5bf11ea56d7fb6b03 |
| b9a0baf82feb08e42fa6ca53e9ec379e79fbe8362a7dac6150eb39c2d33d94ad |
| bdd4fa8e97e5e6eaaac8d6178f1cf4c324b9c59fc276fd6b368e811b327ccf8b |
| c56bcb513248885673645ff1df44d3661a75cfacdce485535da898aa9ba320d4 |
| c77438e8657518221613fbce451c664a75f05beea2184a3ae67f30ea71d34f37 |
| cec425b3383890b63f5022054c396f6d510fae436041add935cd6ce42033f621 |
| cf23ea0d63b4c4c348865cefd70c35727ea8c82ba86d56635e488d816e60ea45 |
| d477ec94e522b8d741f46b2c00291da05c72d21c359244ccb1c211c12b635899 |
| d49cf23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd1344528c195 |
| daaa102d82550f97642887514093c98ccd51735e025995c2cc14718330a856f4 |
| e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e |
| ea433739fb708f5d25c937925e499c8d2228bf245653ee89a6f3d26a5fd00b7a |
| ed0c3e75b7ac2587a5892ca951707b4e0dd9c8b18aaf8590c24720d73aa6b90c |
| f0d85b65b9f6942c75271209138ab24a73da29a06bc6cc4faeddcb825058c09d |
| fe5f8388ccea7c548d587d1e2843921c038a9f4ddad3cb03f3aa8a45c29c6a2f |
**4.2 GoAnywhere Campaign Indicators of Compromise**
|  |
| --- | --- | --- | **Files** | **Hash** | **Description** | larabqFa.exe Qboxdv.dll | 0e3a14638456f4451fe8d76  fdc04e591fba942c2f16da3 1857ca66293a58a4c3 | Truebot | %TMP%\7ZipSfx.000\Zoom.exe | 1285aa7e6ee729be808c46 c069e30a9ee9ce34287151 076ba81a0bea0508ff7e | Spawns a PowerShell subprocess which executes a malicious DLL file | %TMP%\7ZipSfx.000\ANetDiag.dll | 2c8d58f439c708c28ac4ad 4a0e9f93046cf076fc6e5ab 1088e8943c0909acbc4 | Obfuscated malware which also uses long sleeps and  debug detection to evade analysis | AVICaptures.dll | a8569c78af187d603eecdc 5faec860458919349eef510  91893b705f466340ecd | Truebot | kpdphhajHbFerUr.exe gamft.dll | c042ad2947caf4449295a5  1f9d640d722b5a6ec69575 23ebf68cddb87ef3545c | Truebot | dnSjujahur.exe Pxaz.dll | c9b874d54c18e895face05 5eeb6faa2da7965a336d70  303d0bd6047bec27a29d | Truebot | 7ZSfxMod\_x86.exe ZoomInstaller.exe Zoom.exe | d5bbcaa0c3eeea17f12a5c c3dbcaffff423d00562acb69 4561841bcfe984a3b7 | Fake Zoom installer - Truebot | update.jsp | eb9f5cbe71f9658d38fb4a7  aa101ad40534c4c93ee73e f5f6886d89159b0e2c2 | Java Server Pages (JSP) web  shell with some base64 obfuscation | %TMP%\<folder>\extracted\_at\_0x e5c8f00.exe | f2f08e4f108aaffaadc3d11b ad24abdd625a77e0ee9674 c4541b562c78415765 | Employs sandbox detection and string obfuscation - appears to be a collection of  C# hack tools | UhfdkUSwkFKedUUi.exe gamft.dll | ff8c8c8bfba5f2ba2f800325 5949678df209dbff95e16f2f 3c338cfa0fd1b885 | Truebot |  |
| --- | --- | **Email Address** | **Description** | unlock@rsv-box[.]com | CL0P communication email | unlock@support-mult[.]com | CL0P communication email | rey14000707@gmail[.]com | Login/Download | gagnondani225@gmail[.]com | Email |  | --- | **Malicious Domain** | [http://hiperfdhaus](http://hiperfdhaus/)[.]com | [http://jirostrogud](http://jirostrogud/)[.]com | [http://qweastradoc](http://qweastradoc/)[.]com | [http://qweastradoc](http://qweastradoc/)[.]com/gate.php | [http://connectzoomdownload[](http://connectzoomdownload/).]com/download/ZoomInstaller.exe | https://connectzoomdownload[.]com/download/ZoomInstaller.exe |  |  |  | --- | --- | --- | --- | --- | **Certificate Name** | **Status** | **Date Valid** | **Thumbprint** | **Serial Number** | Savas Investments PTY LTD | Valid Issuer: Sectigo Public Code Signing CA R36 | 10/7/2022 -  10/7/2023 | 8DCCF6AD21A58226521 | 00-82-D2-24-  32-3E-FA-65-  06-0B-64- 1F-  51-FA-DF-EF-  02 | E36D7E5DBAD133331C181 |  |
| --- | --- | **MOVEit Campaign Infrastructure IP AddressesMay/June 2023** | **GoAnywhere Campaign Infrastructure IP AddressesJanuary/February 2023** | 104.194.222[.]107 | 100.21.161[.]34 | 138.197.152[.]201 | 104.200.72[.]149 | 146.0.77[.]141 | 107.181.161[.]207 | 146.0.77[.]155 | 141.101.68[.]154 | 146.0.77[.]183 | 141.101.68[.]166 | 148.113.152[.]144 | 142.44.212[.]178 | 162.244.34[.]26 | 143.31.133[.]99 | 162.244.35[.]6 | 148.113.159[.]146 | 179.60.150[.]143 | 148.113.159[.]213 | 185.104.194[.]156 | 15.235.13[.]184 | 185.104.194[.]24 | 15.235.83[.]73 | 185.104.194[.]40 | 162.158.129[.]79 | 185.117.88[.]17 | 166.70.47[.]90 | 185.162.128[.]75 | 172.71.134[.]76 | 185.174.100[.]215 | 173.254.236[.]131 | 185.174.100[.]250 | 185.104.194[.]134 | 185.181.229[.]240 | 185.117.88[.]2 | 185.181.229[.]73 | 185.174.100[.]17 | 185.183.32[.]122 | 185.33.86[.]225 | 185.185.50[.]172 | 185.33.87[.]126 | 188.241.58[.]244 | 185.80.52[.]230 | 193.169.245[.]79 | 185.81.113[.]156 | 194.33.40[.]103 | 192.42.116[.]191 | 194.33.40[.]104 | 195.38.8[.]241 | 194.33.40[.1]64 | 198.137.247[.]10 | 198.12.76[.]214 | 198.199.74[.]207 | 198.27.75[.]110 | 198.199.74[.]207:1234/update.jsp | 206.221.182[.]106 | 198.245.13[.]4 | 209.127.116[.]122 | 20.47.120[.]195 | 209.127.4[.]22 | 208.115.199[.]25 | 209.222.103[.]170 | 209.222.98[.]25 | 209.97.137[.]33 | 213.121.182[.]84 | 45.227.253[.]133 | 216.144.248[.]20 | 45.227.253[.]147 | 23.237.114[.]154 | 45.227.253[.]50 | 23.237.56[.]234 | 45.227.253[.]6 | 3.101.53[.]11 | 45.227.253[.]82 | 44.206.3[.]111 | 45.56.165[.]248 | 45.182.189[.]200 | 5.149.248[.]68 | 45.182.189[.]228 | 5.149.250[.]74 | 45.182.189[.]229 | 5.149.250[.]92 | 5.149.250[.]90 | 5.188.86[.]114 | 5.149.252[.]51 | 5.188.86[.]250 | 5.188.206[.]76 | 5.188.87[.]194 | 5.188.206.76[:]8000/se1.dll | 5.188.87[.]226 | 5.34.178[.]27 | 5.188.87[.]27 | 5.34.178[.]28 | 5.252.23[.]116 | 5.34.178[.]30 | 5.252.25[.]88 | 5.34.178[.]31 | 5.34.180[.]205 | 5.34.180[.]48 | 62.112.11[.]57 | 50.7.118[.]90 | 62.182.82[.]19 | 54.184.187[.]134 | 62.182.85[.]234 | 54.39.133[.]41 | 66.85.26[.]215 | 63.143.42[.]242 | 66.85.26[.]234 | 68.156.159[.]10 | 66.85.26[.]248 | 74.218.67[.]242 | 79.141.160[.]78 | 76.117.196[.]3 | 79.141.160[.]83 | 79.141.160[.]78 | 84.234.96[.]104 | 79.141.161[.]82 | 84.234.96[.]31 | 79.141.173[.]94 | 89.39.104[.]118 | 81.56.49[.]148 | 89.39.105[.]108 | 82.117.252[.]141 | 91.202.4[.]76 | 82.117.252[.]142 | 91.222.174[.]95 | 82.117.252[.]97 | 91.229.76[.]187 | 88.214.27[.]100 | 93.190.142[.]131 | 88.214.27[.]101 |  | 91.222.174[.]68 |  | 91.223.227[.]140 |  | 92.118.36[.]210 |  | 92.118.36[.]213 |  | 92.118.36[.]249 |  | 96.10.22[.]178 |  | 96.44.181[.]131 |  | 5.252.23[.]116 |  | 5.252.25[.]88 |  | 84.234.96[.]104 |  | 89.39.105[.]108 |  | 138.197.152[.]201 |  | 148.113.152[.]144 |  | 198.12.76[.]214 |  | 209.97.137[.]33 |  | 209.222.103[.]170 |
**5.0 Recommendations**
MyCERT recommends users and administrators to follow the security best practices as recommended below to improve their organization’s security posture.
- Reduce threat of malicious actors using remote access tools by:
- Auditing remote access tools.
- Reviewing logs for execution of remote access software.
- Using security software.
- Requiring authorized remote access solutions.
- Blocking both inbound and outbound connections.
- Implement application controls.
- Strictly limit the use of RDP and other remote desktop services.
- Disable command-line and scripting.
- Restrict the use of PowerShell.
- Update Windows PowerShell or PowerShell Core.
- Review domain controllers, servers, workstation, and active directories.
- Audit user accounts with administrative privileges.
- Reduce the threat of credential compromise.
- Implement time-based access for accounts.
In addition, MyCERT recommend apply the following recommendation to limit potential adversarial use of common system and network discovery techniques and to reduce the impact and risk of compromise by ransomware or data extortion actors:
- Implement a recovery plan.
- Maintain offline backups of data.
- Require multifactor authentication.
- Keep all operating systems, software and firmware up to date.
- Segment networks.
- Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.
- Install, regularly update, and enable real time detection for antivirus software.
- Disable unused ports and hyperlinks.
- Consider adding and email banner to emails.
- Ensure all backup data is encrypted, immutable.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
- <https://www.cisa.gov/sites/default/files/2023-06/aa23-158a-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability_5_0.pdf>
- <https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a>
- <https://www.bleepingcomputer.com/news/security/clop-ransomware-likely-testing-moveit-zero-day-since-2021/>