Surge in MOVEit Transfer Scanning Activity Could Signal Emerging Threat Activity

Summary: GreyNoise observed scanning of MOVEit Transfer systems jump from fewer than 10 IPs per day to over 100 on May 27, 2025, then 319 on May 28, with daily volume staying intermittently between 200 and 300 IPs afterward. Low-volume exploitation attempts on June 12, 2025 targeted two previously disclosed MOVEit Transfer vulnerabilities, CVE-2023-34362 and CVE-2023-36934, with no widespread exploitation observed.
What you should know: GreyNoise notes these scanning patterns often precede new vulnerabilities by two to four weeks, and the concentration of scanner IPs in a small number of cloud providers, particularly a single ASN, points to deliberate, programmatically managed activity rather than random probing.

Read the original at GreyNoise Blog ↗

Mentions: CVE-2023-34362 CVE-2023-36934
Related: Threat Brief - MOVEit Transfer SQL Injection Vulnerabilities: CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 (Updated Oct 4) Cyber Risks ·
CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability Known Exploited Vulnerabilities · Jun 02, 2023
Active exploitation of the MOVEit Transfer vulnerability — CVE-2023-34362 — by Clop ransomware group Cyber Risks ·