Lemurloot

LemurLoot is a malicious software, or malware, specifically a web shell written in C# that targets the MOVEit Transfer platform. It was developed and deployed by the CL0P ransomware group to exploit vulnerabilities in systems and steal data. In May 2023, the group exploited a SQL injection zero-day vulnerability identified as CVE-2023-34362 to install LemurLoot on MOVEit Transfer web applications. This harmful program can infiltrate systems through suspicious downloads, emails, or websites, often without the user's knowledge, and once inside, it can disrupt operations, steal personal information, or hold data hostage for ransom. The attack involved infecting internet-facing MOVEit Transfer web applications with LemurLoot, which was then used to steal data from underlying MOVEit Transfer databases and internal servers. The Cl0P ransomware group has been associated with other attacks using similar tools such as DEWMODE web shell, SDBot, and the FlawedAmmyy remote access trojan (RAT). This recent exploitation of MOVEit Transfer web applications with LemurLoot showcases the group's expanding repertoire and their ability to hack and steal critical data. The use of web shells like LemurLoot has grown dramatically, with Microsoft noting nearly double the encounters of web shells on monitored servers compared to the prior year, according to an analysis done in 2021. Cl0P notably dropped the DEWMODE and LEMURLOOT Web shells after exploiting vulnerabilities in Kiteworks Accellion FTA in 2020 and Progress Software's MOVEit managed file transfer service in May 2023. These instances highlight the increasing threat posed by such malware and the need for robust cybersecurity measures.