Infrastructure & Reliability · Middleware — File transfer · Chapter 32 of 33
The most attacked middleware: MFT breaches and what they teach
Accellion, GoAnywhere, MOVEit, Cleo and GoAnywhere again — five mass exploitations of file-transfer products in five years, a central bank among the victims, and the controls that would have limited each.
If a criminal group could design the perfect target, it would be a server that is reachable from the internet by design, holds the most sensitive bulk data an organisation has — payroll, statements, customer lists — and is the same product at hundreds of organisations at once, so that one vulnerability opens all of them in the same week. That is a description of a managed file transfer (MFT) server, and since 2020 attackers have treated it accordingly.
Case 1 — a central bank, and a warning that never arrived
The Reserve Bank of New Zealand used Accellion’s File Transfer Appliance (FTA), a product about twenty years old, to share information with outside parties. According to the independent KPMG review of the incident, as reported by iTnews: the security firm FireEye alerted Accellion to active exploitation on 16 December 2020; attackers breached the bank’s appliance on Christmas Day; the bank did not receive Accellion’s notification until 6 January 2021 — the governor said the vendor’s notifications “did not leave their system” — and it disclosed the breach on 11 January. Australia’s securities regulator was hit through the same product.
The review did not stop at the vendor. It found the bank had breached its own 2014 guidelines by keeping too much data on the appliance, and had not acted on security alerts the product raised by default. The bank put the cost of its response at around NZ$3.5 million.
Three lessons from one incident
A vendor’s email is not a vulnerability-management process. Subscribe to several independent sources — the US Cybersecurity and Infrastructure Security Agency’s catalogue of known exploited vulnerabilities (CISA KEV), vendor advisories, threat intelligence — so no single notification path is a single point of failure.
A transfer server is not a storage server. Delete files once delivered; the data an attacker can steal is the data you kept.
End-of-life products are the ones nobody is watching. The appliance was being superseded by its vendor’s newer product — Accellion later renamed itself Kiteworks, after that product.
Case 2 — MOVEit, and breach through a supplier
On 31 May 2023, Progress Software disclosed CVE-2023-34362 in MOVEit Transfer: a SQL injection flaw, meaning an attacker could smuggle database commands into input the application passed to its database. It was already being exploited. Within weeks the security firm Emsisoft’s running tally — compiled from breach notifications, regulatory filings and the attackers’ own leak site, and explicitly an estimate — passed 2,000 organisations and later reached roughly 2,700 organisations and more than 84 million people.
The feature that matters for a bank is how many victims never ran MOVEit themselves. Their data sat on the MOVEit servers of payroll providers, pension administrators and other suppliers. A bank can be breached through a vendor’s file-transfer server, which is why third-party risk questionnaires now ask which MFT product a supplier runs, and how quickly it patches.
Case 3 — Cleo, and the patch that was not a fix
Cleo’s Harmony, VLTrader and LexiCom products had a file-upload flaw, CVE-2024-50623, patched in October 2024. The patch was incomplete: in December, organisations that had applied it were compromised through a related flaw, CVE-2024-55956, and the US Cybersecurity and Infrastructure Security Agency (CISA) added both to its catalogue of actively exploited vulnerabilities with patch deadlines in early January 2025. “Patched” is a claim to verify, not a state to record and forget.
Case 4 — GoAnywhere, exploited before the advisory
Fortra’s GoAnywhere MFT was hit twice. In early 2023, CVE-2023-0669 let attackers run code through an administration console exposed to the internet; Cl0p claimed about 130 victims, a number the press could not verify. In September 2025 came CVE-2025-10035, rated 10.0 — the maximum — on the Common Vulnerability Scoring System: a flaw in how the product checked licence responses allowed an attacker to make it deserialise data of the attacker’s choosing, that is, to rebuild program objects from it, and so run commands. Microsoft attributed the exploitation to a group it tracks as Storm-1175, which deploys Medusa ransomware.
The controls, in order of value
| Control | What it stops | Cost |
|---|---|---|
| Keep the administration interface off the internet | The entry point in several of these cases | Nothing but discipline |
| A gateway in the demilitarised zone (DMZ) that stores no files, with the internal server connecting outwards | A compromised edge reaching data or the internal network | Architecture, designed in from the start |
| Short retention: delete files once delivered and confirmed | Most of what there is to steal | Agreeing retention with each business owner |
| Pretty Good Privacy (PGP) encryption of payloads, end to end | Stolen files being readable | Key management with partners |
| A pre-approved emergency change to patch internet-facing MFT within hours | The exposure window after an advisory | A standing agreement with change management |
| Several vulnerability-intelligence sources, not the vendor’s email alone | The Reserve Bank of New Zealand’s eleven-day gap | A feed subscription and an owner |
| Detection on the MFT host: new files in application directories, new admin users, unusual download volumes, connections to cloud storage | Silent persistence and exfiltration | EDR licences and tuning |
| Segmentation: the MFT host cannot open connections to internal servers it has no reason to reach | Lateral movement | Firewall rules |
| Supplier questions: which MFT product, which version, what patch time | Breach through a vendor | Part of existing third-party risk |
| Retire end-of-life transfer products | The unwatched appliance | A migration project |
How to run the response when the next campaign lands is in incident response, and how to find these weaknesses before an attacker does is in threat modelling.
The first 24 hours after the next advisory
There will be another campaign. The response is predictable enough to be written in advance, and a bank that has written it spends the day executing rather than deciding:
| When | What to do |
|---|---|
| Hour 0 | The advisory or a CISA KEV listing lands. Confirm exposure from the inventory: which product, which version, which instances face the internet |
| Hour 1 | If exploitable and unpatched, restrict the internet-facing interface to partners’ known addresses, or take it offline — a business decision, pre-agreed with the flow owners |
| Hours 2–4 | Apply the fix or the vendor’s mitigation under the pre-approved emergency change |
| Hours 4–12 | Hunt: new administrator accounts, new files in application directories, unusual download volumes, remote-access tools, outbound connections to cloud storage |
| Hours 12–24 | Assume anything stored on the server during the exposure window may be gone. Establish what that was — short retention now pays for itself — and start the notification clock |
The clock is short. In India, the CERT-In directions of April 2022 require specified cyber incidents to be reported within six hours of being noticed; the detail, and the other regimes, are in India regulation. A team that first reads the reporting rules during the incident has already used up part of the window.
Check yourself