Recommended Free Tools
Managed file transfer (MFT) systems keep appearing in breach reports because they move sensitive files between organizations and systems—and are sometimes reachable from the internet. The recurring story is not one flaw being exploited repeatedly: incidents involving Fortra GoAnywhere and Progress MOVEit used different vulnerabilities, with consequences ranging from data theft to ransomware deployment.
Why MFT systems attract attackers
MFT software automates the exchange of files such as business records and other sensitive data. That makes it a valuable enterprise service, but also a high-value target. An internet-facing transfer application or administration component can give an attacker a route to stored data or, depending on the flaw and system, remote access that supports further activity.
As an Amazon Associate I earn from qualifying purchases.
The incidents below share that operational risk, not a common defect. The vulnerabilities included command injection, SQL injection, and improper authentication. Similar headlines therefore should not be read as evidence of a single continuous campaign or a vulnerability shared across products.
What happened in the cited incidents
| Date and product | Vulnerability and affected component | What the sources reported |
|---|---|---|
| March 2023 — Fortra GoAnywhere | CVE-2023-0669, a pre-authentication command-injection flaw in the administration console | Singapore’s Cyber Security Agency (CSA) described active exploitation in a ransomware campaign. Successful exploitation could enable remote code execution on vulnerable instances with an internet-exposed administration console. CSA advised immediate patching, scanning for indicators of compromise (IOCs), firewall controls, and limiting open ports. |
| From May 27, 2023 — Progress MOVEit Transfer | CVE-2023-34362, a SQL injection flaw in MOVEit web applications | The FBI and CISA joint advisory said that, according to open-source information, CL0P/TA505 began exploiting the previously unknown flaw on May 27. Internet-facing applications were infected with the LEMURLOOT web shell, which was used to steal data from underlying databases. |
| June 2024 — Progress MOVEit Gateway and Transfer | Improper-authentication vulnerabilities; MOVEit Transfer CVE-2024-5806 affected versions 2023.0.0 before 2023.0.11, 2023.1.0 before 2023.1.6, and 2024.0.0 before 2024.0.2 | The U.S. Department of Health and Human Services Health Sector Cybersecurity Coordination Center (HHS HC3) reported the vulnerabilities. CSA described the SFTP-module flaw as potentially enabling authentication bypass and unauthorized access. In its June 27, 2024 alert, HHS HC3 reported that Censys had identified 2,700 vulnerable MOVEit MFT instances accessible from the internet at the time of its research; most were physically located in the United States. This is a dated exposure count, not a current total. |
| September–October 2025 — Fortra GoAnywhere | CVE-2025-10035 in the License Servlet; MS-ISAC identified versions before 7.8.4 or Sustain Release 7.6.3 as affected | On September 19, 2025, MS-ISAC said it had no reports of in-the-wild exploitation. Microsoft later documented Storm-1175 exploitation activity, including follow-on discovery, persistence, lateral movement, exfiltration, and Medusa ransomware deployment in one compromised environment. These statements reflect different publication dates: the later report does not make the September snapshot an account of what was known at that time. |
The FBI/CISA advisory also situated the 2023 MOVEit activity in a broader history of TA505 zero-day campaigns against Accellion FTA in 2020–2021 and GoAnywhere in early 2023. That context does not make the vulnerabilities identical.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What the pattern does—and does not—show
A repeated exposure problem, not one recurring bug
The incidents illustrate how an exposed file-transfer service can become an entry point or a means to steal data. They do not establish that all MFT products have the same weakness, or that every incident was part of one campaign. The specific product, affected component, flaw, and attacker activity differed.
No single victim total can be drawn from these reports
The cited sources do not provide a comparable aggregate count of affected organizations across all the incidents. The 2,700 figure is specifically a Censys count of internet-accessible vulnerable MOVEit instances reported by HHS HC3 in 2024—not a count of victims, and not a measure of current exposure.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
How to check whether your file-transfer server was exposed
- Inventory every instance. Identify each MFT deployment, its owner, product, version, and internet-reachable components. Include systems managed by separate teams or hosted in different environments.
- Match the version to the exact advisory. Determine whether the instance falls within the affected range for the relevant CVE. For MOVEit Transfer CVE-2024-5806, the ranges reported by HHS HC3 were 2023.0.0 before 2023.0.11, 2023.1.0 before 2023.1.6, and 2024.0.0 before 2024.0.2. For GoAnywhere CVE-2025-10035, MS-ISAC identified versions before 7.8.4 or Sustain Release 7.6.3 as affected. Confirm the applicable fixed release in the vendor’s current advisory before making changes.
- Establish exposure during the relevant period. Check whether the affected service or administration interface was reachable from the internet while vulnerable. Review firewall rules, network configuration, and logs; a server’s current configuration does not by itself establish its past exposure.
- Apply the vendor’s fix and reduce exposure. Upgrade to the fixed release for the specific vulnerability. Restrict administration interfaces and unnecessary ports, and use network controls to limit access to the service.
- Look for evidence of earlier exploitation. Review relevant logs and indicators of compromise, using the applicable security advisories. If compromise is plausible, involve incident-response specialists and investigate for persistence, lateral movement, and data access or exfiltration.
Why installing a patch may not finish the response
A patch closes the vulnerability in the software version being updated; it does not establish whether an attacker exploited the earlier version, remove any persistence left behind, or reverse data already taken. Microsoft explicitly warns that upgrading does not address prior exploitation. When a system was exposed while vulnerable, pair the upgrade with an investigation rather than treating the update as proof that the incident is resolved.
The FBI and CISA’s joint MOVEit advisory states: “Regularly patch and update software and applications to their latest versions, and conduct regular vulnerability assessments.” For an exposed MFT service, that advice complements—not replaces—inventory, access controls, monitoring, and investigation when compromise is suspected.
Quick Recap
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
