The Next MOVEit May Already Be in Your File Transfer Queue

Spectra Assure Free Trial Get your 14-day free trial of Spectra Assure for Software Supply Chain Security Get Free TrialMore about Spectra Assure Free TrialPayload inspection matters because of where malware sits before anyone opens it. EDR is indispensable for endpoint prevention, telemetry, and response, including controls that may act before execution. But it is not a substitute for inspecting a file while it is still upstream — in an MFT queue, landing zone, file share, or inbound email workflow — before it reaches an endpoint or triggers endpoint telemetry. A file sitting in a transfer queue, a file share, or an inbox hasn't executed anything yet, so it passes through ingestion, storage, and replication before EDR ever gets a look at it. AV-TEST logs more than 450,000 new malicious samples every day, and relying on execution-time detection to catch each one before it runs leaves that entire window uncovered. Closing it means evaluating the file itself on arrival, not waiting for it to run. E-signature platforms carry the same concentration risk in a different form: high volumes of documents from external senders that employees are trained to open and act on quickly. Darktrace tracked a July 2026 spearphishing campaign that impersonated DocuSign specifically to target technology executives, sent from compromised domains with legitimate reputations, and DocuSign-themed phishing remains effective because users expect documents, invoices, and signature requests to arrive through trusted workflows. Threat actors have also abused DocuSign’s Envelopes API to distribute fraudulent invoices originating from legitimate DocuSign infrastructure. Not every incident in this category involves a malicious file, and the distinction matters. A U.S. Department of Health and Human Services sector alert documents attackers using genuine DocuSign accounts and the Envelopes API to send fraudulent invoices that pass SPF and DKIM checks, because the traffic really does originate from DocuSign's infrastructure. That's a fraud pattern built on a legitimate-looking request for payment, not a malicious attachment, and no file-inspection tool, including Spectra Detect, is positioned to catch it. Where these workflows do carry risk that payload inspection can address is when the signature-request lure itself delivers a malicious file — a weaponized PDF or a macro-laden Office document attached to, or linked from, the request to review and sign. The fix for the pre-execution gap, and for the malicious-file variant of trust exploitation described above, is evaluating the file's actual content before it is opened or executed, not the identity of the sender and not the behavior of a process that hasn't run yet. This doesn't replace patch management or EDR; it adds the layer both leave uncovered. For MFT systems, vendor portals, and EDI pipelines, inspection typically applies in one of two ways: inline at the gateway or proxy layer, intercepting files as they cross the network boundary, or through continuous scanning of the file shares and cloud landing zones where transferred payloads come to rest. The first catches a payload before it reaches its destination; the second catches payloads that have already landed, including ones that were clean on arrival and were reclassified later as new intelligence emerged. For e-signature workflows, the same inline model applies at the email gateway: the attachment or linked document is inspected on arrival, with nested containers such as a PDF inside a ZIP file or a macro-laden Office document unpacked to find a malicious payload hidden behind the request to review and sign. It does not evaluate whether the underlying transaction or invoice itself is fraudulent. Spectra Detect implements this mechanism directly. It recursively deconstructs nested archives and containers across more than 4,800 file types and more than 400 archive formats, and it returns a static, AI-driven verdict without executing the file. Deployment follows the two inline patterns described above: ICAP-based inspection at the gateway or proxy layer, or continuous scanning of file shares and cloud landing zones. Verdicts draw on a reputation database of more than 40 billion files, and the system scales to millions of files a day. Spectra Detect returns a static verdict and rich file intelligence to help security teams identify malicious or suspicious files, prioritize investigation, and enforce workflow-specific policy before files are delivered or acted upon. Learn about how ReversingLabs won the 2026 CyberSecurity Breakthrough Award for Threat Detection Solution Provider of the Year. Post-quantum readiness depends on knowing where cryptography lives in the software you run, and a list of components can't tell you that. ReversingLabs identified and classified the malware weeks before the report was published — showing why behavioral intelligence and historical telemetry matter in the AI age. With this integration, Rubrik users can now tap ReversingLabs' ransomware feed to decide whether each file in their backup is safe.