Increased Threat Landscape for MOVEit Transfer Amidst Rising Scanning Activities
June 27, 2025
In a recent update, cybersecurity firm GreyNoise has reported a significant surge in scanning activities targeting Progress MOVEit Transfer systems. This uptick, which began on May 27, 2025, raises concerns that cybercriminals may be gearing up for a mass exploitation campaign or actively searching for unpatched vulnerabilities within the software. MOVEit Transfer, a widely utilized managed file transfer solution, is favored by various businesses and government entities for its ability to facilitate secure data sharing of sensitive information. Its reputation for handling high-value data makes it an appealing target for malicious actors.
Prior to the recent spike in scanning activities, the monitoring data indicated that fewer than ten unique IP addresses were typically seen scanning MOVEit systems each day. However, on May 27, that figure escalated dramatically to over one hundred IPs, with another jump to 319 IPs the following day. Since then, the daily volume of scanning IPs has fluctuated between 200 to 300, a substantial departure from the norm and indicative of heightened malicious interest in this software.
In total, as many as 682 unique IPs have been identified as actively probing MOVEit Transfer installations, underscoring a trend that cybersecurity experts believe denotes significant risk. The timing aligns with the emergence of Common Vulnerabilities and Exposures (CVE) affecting the MOVEit Transfer solution, suggesting that attackers are likely leveraging these vulnerabilities to gain access to critical systems.
Businesses that rely on MOVEit Transfer must be vigilant, as this scanning activity may point to attempts at gaining initial access to their networks. The MITRE ATT&CK framework reveals that techniques involved in such probing often include efforts to identify unpatched systems, which could lead to privilege escalation and, ultimately, unauthorized data access. Defensive measures should therefore be prioritized, emphasizing timely patching and enhanced monitoring of network traffic.
Given the nature of this rising threat landscape, affected organizations should consider implementing additional security protocols to safeguard their environments. Enhanced intrusion detection systems and thorough vulnerability assessments may help mitigate the risks posed by potential exploitation attempts.
As the scanning activity continues to show persistent levels, businesses operating in sectors where MOVEit Transfer is employed are advised to remain alert and adaptable in their security strategies. Preparedness against evolving cyber threats remains crucial, as the consequences of successful intrusions can be far-reaching, impacting both organizational integrity and customer trust.
Industry experts emphasize that proactive measures and an informed approach to cybersecurity are essential in light of these developments. Keeping abreast of current threats and vulnerabilities will empower organizations to better defend against the increasing risks posed by malicious cyber actors.
