MOVEit Transfer Faces Increased Threats as Scanning Surges and CVE Flaws Are Targeted

Jun 27, 2025Ravie LakshmananNetwork Safety / Vulnerability
Menace intelligence agency GreyNoise is warning of a “notable surge” in scanning exercise concentrating on Progress MOVEit Switch techniques beginning Could 27, 2025—suggesting that attackers could also be making ready for one more mass exploitation marketing campaign or probing for unpatched techniques.MOVEit Switch is a well-liked managed file switch answer utilized by companies and authorities businesses to share delicate information securely. As a result of it typically handles high-value data, it has develop into a favourite goal for attackers.
“Previous to this date, scanning was minimal — usually fewer than 10 IPs noticed per day,” the corporate stated. “However on Could 27, that quantity spiked to over 100 distinctive IPs, adopted by 319 IPs on Could 28.”
Since then, day by day scanner IP quantity has remained intermittently elevated between 200 to 300 IPs per day, GreyNoise added, stating it marks a “important deviation” from ordinary conduct.

As many as 682 distinctive IPs have been flagged in reference to the exercise over the previous 90 days, with 449 IP addresses noticed previously 24 hours alone. Of the 449 IPs, 344 have been categorized as suspicious and 77 have been marked malicious.
A majority of the IP addresses geolocate to the USA, adopted by Germany, Japan, Singapore, Brazil, the Netherlands, South Korea, Hong Kong, and Indonesia.

GreyNoise additionally stated it detected low-volume exploitation makes an attempt to weaponize two identified MOVEit Switch flaws (CVE-2023-34362 and CVE-2023-36934) on June 12, 2025. It is price noting that CVE-2023-34362 was abused by Cl0p ransomware actors as a part of a widespread marketing campaign in 2023, impacting greater than 2,770 organizations.
The spike in scanning exercise is a sign that MOVEit Switch situations are as soon as once more beneath the risk actor’s scanner, making it important that customers block the offending IP addresses, be sure that the software program is up-to-date, and keep away from publicly exposing them over the web.

Discovered this text fascinating? Comply with us on Twitter  and LinkedIn to learn extra unique content material we publish.