MOVEit Transfer Zero-Day: Cl0p’s Memorial Day Heist
CVE-2023-34362 in MOVEit Transfer let Cl0p deploy the LEMURLOOT web shell at scale over Memorial Day weekend — pure data extortion, no encryption, hundreds of downstream victims.
MOVEit’s Ledger: 2,700 Orgs, 93 Million People
Cl0p’s June 2023 listing waves turned the MOVEit breach into a running census — 2,700+ organizations and ~93M individuals per Emsisoft tallies. The economics of encryption-free extortion.
2022–2024: Lapsus$, Change Healthcare & the XZ Backdoor
The current era: social engineering teenage crews beating billion-dollar defenses, extortion without encryption, a single company’s collapse freezing America’s pharmacies — and the closest the internet has ever come to a supply-chain catastrophe.