The Next MOVEit May Already Be in Your File Transfer Queue
The Next MOVEit May Already Be in Your File Transfer Queue
Managed file transfer (MFT) systems, vendor portals, EDI pipelines, and e-signature platforms share a common vulnerability: they concentrate valuable files, privileged access, and trusted connections to numerous external parties in one place. This concentration makes them recurring targets, as demonstrated by Cl0p’s 2023 MOVEit campaign, which affected 2,773 organizations and 95,788,491 individuals based on disclosures available as of June 28, 2024.
Two Distinct Threats
Once a system reaches a high level of exposure, two distinct threats emerge, each requiring different defenses:
Exploitation of the Transfer Application: The GoAnywhere MFT was targeted in Cl0p’s 2023 campaign. In September 2025, a separate campaign exploited CVE-2025-10035, a CVSS 10.0 deserialization vulnerability in GoAnywhere’s License Servlet. Microsoft attributed this exploitation to Storm-1175, a group known for deploying Medusa ransomware. Cl0p also breached Cleo’s file-transfer products in December 2024, which included the Hertz breach. In 2025, Cl0p-linked extortion activity targeted Oracle E-Business Suite environments, with Oracle’s advisory describing CVE-2025-61882 as an unauthenticated, remotely exploitable RCE vulnerability. Cl0p later named 29 alleged victims, including Harvard, Envoy Air, and The Washington Post, who publicly acknowledged the impact or targeting.
Malicious Files: Even in a fully patched environment, a malicious file can still travel through a trusted transfer channel to a recipient who opens it. Patching protects the transfer application, while payload inspection safeguards what travels through it. Endpoint Detection and Response (EDR) is crucial for prevention, telemetry, and response, including controls that may act before execution. However, it cannot replace the need for inspecting a file while it is still upstream before it reaches an endpoint or triggers telemetry. A system needs both defenses because closing application vulnerabilities does not prevent a legitimate-looking file carrying a malicious payload from moving through the same trusted channel undetected.
The E-signature Risk
E-signature platforms also carry concentration risks in a different form: high volumes of documents from external senders that employees are trained to open quickly. Darktrace tracked a July 2026 spear-phishing campaign that impersonated DocuSign, specifically targeting technology executives. This campaign was sent from compromised domains with legitimate reputations. DocuSign-themed phishing remains effective because users expect documents, invoices, and signature requests to arrive through trusted workflows. Threat actors have abused DocuSign’s Envelopes API to distribute fraudulent invoices originating from legitimate infrastructure.
Conclusion
The solution for the pre-execution gap and the malicious-file variant of trust exploitation is to evaluate the file’s actual content before it is opened or executed, rather than relying solely on the sender’s identity or the behavior of a process that hasn’t run yet. This approach does not replace patch management or EDR; it adds a necessary layer that both leave uncovered.