MANAGED FILE TRANSFER / EXPOSURE NOTE

Scanning is a signal.
Investigate the exposure.

Respond to MOVEit activity using product versions, security notices, and evidence from your own service.

Read the practical brief ↓
MOVEit Under Attack Again? Surge in Scans Signals a New Threat
Original supporting illustration; illustrative rather than incident evidence.

Research and presentation reviewed 20 October 2026

An increase in scanning is a reason to examine exposure, not proof that a new vulnerability exists or that a particular server has been compromised. The distinction matters when deciding what to patch, investigate, or take offline.

MOVEit has a serious history of exploitation. The observations in May and June 2025 need to be read with their dates and evidence attached, so the response addresses actual exposure.

THE EXECUTIVE BRIEF

The decisions that matter.

  • Separate discovery traffic, exploitation attempts, and confirmed compromise.
  • Use the vendor’s current guidance for the actual product and version.
  • Treat the file-transfer service as part of a business and supplier data flow.

THE ORIGINAL SIGNAL / MAY–JUNE 2025

The monitoring report was more specific than the headline.

GreyNoise’s 25 June 2025 report described a rise from fewer than 10 scanner IPs a day to over 100 on 27 May and 319 on 28 May. It recorded 682 unique IPs over 90 days and low-volume attempts involving older vulnerabilities on 12 June. At publication, GreyNoise said it had not observed widespread exploitation.

AN EVIDENCE READING CARD

Do not promote one observation into another.

OBSERVED

Scanning

A system or service is being probed. Determine whether the organisation has relevant exposure.

ATTEMPTED

Exploitation activity

A particular malicious request or technique may have been tried. Investigate the version, controls, and evidence.

ESTABLISHED

Compromise

Evidence shows unauthorised access or action. Activate the incident process and assess its scope.

CyberSolace interpretation guide. The three labels are different evidential claims, not an inevitable attack sequence.

Cloud-hosted scanner addresses do not establish who controlled the traffic or which state, if any, directed it. A geographical or infrastructure label is not attribution.

The report’s pattern did not demonstrate a new zero-day. Use it as a dated observation prompting an exposure review, rather than a prediction that a new vulnerability has already been found.

THE EXPLOITATION HISTORY

The older vulnerabilities remain distinct.

The CISA and FBI 2023 advisory describes CL0P exploitation of CVE-2023-34362 in MOVEit Transfer. CVE-2024-5806 is a separate authentication-bypass vulnerability. They should not be merged with each other or treated as proof of the cause of every later scan.

The ENISA 2023 record and 2024 record remain reference routes. A vulnerability record needs to be read alongside the supplier’s current affected-version and remediation information.

An organisation also needs to establish whether it operates the product directly, uses a managed service, or sends data through a partner that uses it. No internally installed server does not necessarily mean no relevant supplier exposure.

THE SERVICE REVIEW

Translate the warning into owned work.

  • Inventory: identify the service owner, product, version, support status, and the information exchanged.
  • Exposure: assess whether public access is necessary and which supported restrictions fit the business use.
  • Maintenance: apply the current vendor-approved remediation through a controlled process and verify completion.
  • Access: review administrator, service, and user accounts, including supplier access and unused permissions.
  • Evidence: retain and examine relevant application and access records for suspicious activity.
  • Recovery: confirm the data, configuration, credentials, and dependencies needed to restore the service.

A web application firewall, IP restriction, VPN, or multi-factor control can address particular risks. None should be described as a universal substitute for fixing an affected version or investigating evidence of compromise.

If the business depends on an externally managed transfer service, ask for an answer specific to the service and data involved. A general assurance statement may not establish whether a particular vulnerability affected the environment.

IF THE EVIDENCE IS UNCLEAR

Escalate the uncertainty rather than declaring the system clean.

A patch changes the current exposure; it does not by itself show whether an earlier intrusion occurred. Work with the supplier and response specialists where relevant to assess past access, suspicious transfers, and the integrity of the service.

Limit retention and access to transferred information according to business and legal needs. A platform holding fewer unnecessary historical files can present a different consequence from one retaining years of sensitive exchanges.

The 2025 monitoring report is historical context. This article does not declare a new current campaign or provide a fixed list of patches for October 2026. Obtain the current supplier advisories for the exact product and version before making a technical change.

A PRACTICAL NEXT STEP

Find the service owner before the next advisory arrives.

CyberSolace can help connect supplier exposure, response evidence, and recovery planning to the information the business exchanges.

Discuss file-transfer assurance ↗

SOURCES & EDITORIAL REVIEW

Historical findings and incident accounts are dated in the text. Illustrative review prompts are CyberSolace commentary. Editorial review: 20 October 2026.