Movin’ Out: Identifying Data Exfiltration in MOVEit Transfer Investigations

Originally published by CrowdStrike. Summary Points Organizations around the globe continue to experience the fallout of the MOVEit Transfer exploit CVE-2023-34362 CrowdStrike incident responders have identified evidence of mass file exfiltration from the MOVEit application, as a result of the webshell activity on compromised MOVEit systemsData exfiltration activity can be identified by analyzing the MOVEit application database and IIS logsBackgroundCrowdStrike incident responders have been a...

application compromised continue crowdstrike cve cve-2023-34362 data data exfiltration exfiltration experience exploit file incident incident responders investigations moveit moveit transfer organizations result transfer webshell