The Next MOVEit May Already Be in Your File Transfer Queue

Spectra Assure Free Trial Get your 14-day free trial of Spectra Assure for Software Supply Chain Security Get Free TrialMore about Spectra Assure Free TrialManaged file transfer (MFT) systems, vendor portals, EDI pipelines, and e-signature platforms have something in common that has nothing to do with how they're built: they concentrate valuable files, privileged access, and trusted connections to dozens or hundreds of external parties in one place. That concentration, not a shared flaw in how these systems are designed, is what makes them recurring targets. Cl0p’s 2023 MOVEit campaign showed the consequences of a compromise at this layer. Emsisoft’s public tally lists 2,773 affected organizations and 95,788,491 individuals, based on disclosures available as of June 28, 2024. The downstream legal and regulatory consequences continue well beyond the initial incident. [ See press release: ReversingLabs Wins 2026 CyberSecurity Breakthrough Award for Threat Detection Solution Provider of the Year ] MFT systems, vendor portals, EDI pipelines, and e-signature platforms sit at the intersection of dozens or hundreds of external relationships. They hold the files organizations exchange with customers, suppliers, and regulators, route privileged credentials to move those files automatically, and stay connected to trusted parties around the clock. Compromise one instance and the payoff extends across every relationship it touches, which is what keeps making these systems attractive regardless of which specific product is involved. Two distinct things can go wrong once a system reaches that level of exposure, and they call for different defenses. The first is exploitation of the transfer application itself. GoAnywhere MFT was targeted in Cl0p’s 2023 campaign. In September 2025, a separate campaign exploited CVE-2025-10035, a CVSS 10.0 deserialization vulnerability in GoAnywhere’s License Servlet; Microsoft attributed observed exploitation to Storm-1175, a group known for deploying Medusa ransomware. Cl0p breached Cleo's file-transfer products in December 2024, a campaign that included the Hertz breach. In 2025, Cl0p-linked extortion activity also targeted Oracle E-Business Suite environments. Oracle’s advisory describes CVE-2025-61882 as an unauthenticated, remotely exploitable RCE vulnerability in the BI Publisher Integration component. Cl0p later named 29 alleged victims, while several organizations — including Harvard, Envoy Air, and The Washington Post — publicly acknowledged impact or targeting. Each of these is a software vulnerability, closed the same way any software vulnerability is closed: through patching and vulnerability management. The second persists even in a fully patched environment: a malicious file can still travel through a trusted transfer channel to a recipient who opens it. Patching protects the transfer application. Payload inspection protects what travels through it. EDR is indispensable for endpoint prevention, telemetry, and response, including controls that may act before execution. But it is not a substitute for inspecting a file while it is still upstream before it reaches an endpoint or triggers endpoint telemetry. A system needs both, because closing the application's vulnerabilities does nothing to stop a legitimate-looking file carrying a malicious payload from moving through the same trusted channel undetected. Payload inspection matters because of where malware sits before anyone opens it. EDR is indispensable for endpoint prevention, telemetry, and response, including controls that may act before execution. But it is not a substitute for inspecting a file while it is still upstream — in an MFT queue, landing zone, file share, or inbound email workflow — before it reaches an endpoint or triggers endpoint telemetry. A file sitting in a transfer queue, a file share, or an inbox hasn't executed anything yet, so it passes through ingestion, storage, and replication before EDR ever gets a look at it. AV-TEST logs more than 450,000 new malicious samples every day, and relying on execution-time detection to catch each one before it runs leaves that entire window uncovered. Closing it means evaluating the file itself on arrival, not waiting for it to run. E-signature platforms carry the same concentration risk in a different form: high volumes of documents from external senders that employees are trained to open and act on quickly. Darktrace tracked a July 2026 spearphishing campaign that impersonated DocuSign specifically to target technology executives, sent from compromised domains with legitimate reputations, and DocuSign-themed phishing remains effective because users expect documents, invoices, and signature requests to arrive through trusted workflows. Threat actors have also abused DocuSign’s Envelopes API to distribute fraudulent invoices originating from legitimate DocuSign infrastructure. Not every incident in this category involves a malicious file, and the distinction matters. A U.S. Department of Health and Human Services sector alert documents attackers using genuine DocuSign accounts and the Envelopes API to send fraudulent invoices that pass SPF and DKIM checks, because the traffic really does originate from DocuSign's infrastructure. That's a fraud pattern built on a legitimate-looking request for payment, not a malicious attachment, and no file-inspection tool, including Spectra Detect, is positioned to catch it. Where these workflows do carry risk that payload inspection can address is when the signature-request lure itself delivers a malicious file — a weaponized PDF or a macro-laden Office document attached to, or linked from, the request to review and sign. The fix for the pre-execution gap, and for the malicious-file variant of trust exploitation described above, is evaluating the file's actual content before it is opened or executed, not the identity of the sender and not the behavior of a process that hasn't run yet. This doesn't replace patch management or EDR; it adds the layer both leave uncovered. For MFT systems, vendor portals, and EDI pipelines, inspection typically applies in one of two ways: inline at the gateway or proxy layer, intercepting files as they cross the network boundary, or through continuous scanning of the file shares and cloud landing zones where transferred payloads come to rest. The first catches a payload before it reaches its destination; the second catches payloads that have already landed, including ones that were clean on arrival and were reclassified later as new intelligence emerged. For e-signature workflows, the same inline model applies at the email gateway: the attachment or linked document is inspected on arrival, with nested containers such as a PDF inside a ZIP file or a macro-laden Office document unpacked to find a malicious payload hidden behind the request to review and sign. It does not evaluate whether the underlying transaction or invoice itself is fraudulent. Spectra Detect implements this mechanism directly. It recursively deconstructs nested archives and containers across more than 4,800 file types and more than 400 archive formats, and it returns a static, AI-driven verdict without executing the file. Deployment follows the two inline patterns described above: ICAP-based inspection at the gateway or proxy layer, or continuous scanning of file shares and cloud landing zones. Verdicts draw on a reputation database of more than 40 billion files, and the system scales to millions of files a day. Spectra Detect returns a static verdict and rich file intelligence to help security teams identify malicious or suspicious files, prioritize investigation, and enforce workflow-specific policy before files are delivered or acted upon. Learn about how ReversingLabs won the 2026 CyberSecurity Breakthrough Award for Threat Detection Solution Provider of the Year. Explore RL's Spectra suite: Spectra Assure for software supply chain security, Spectra Detect for scalable file analysis, Spectra Analyze for malware analysis and threat hunting, and Spectra Intelligence for reputation data and intelligence. Post-quantum readiness depends on knowing where cryptography lives in the software you run, and a list of components can't tell you that. ReversingLabs identified and classified the malware weeks before the report was published — showing why behavioral intelligence and historical telemetry matter in the AI age. With this integration, Rubrik users can now tap ReversingLabs' ransomware feed to decide whether each file in their backup is safe.