Vendor lineage
Progress Software - the company that owns the debugger, the load balancer and MOVEit
An American software company that acquired Telerik, Ipswitch and Kemp, and in 2023 became the origin of one of the largest single data-theft campaigns ever recorded.
Progress Software is an American application and infrastructure software company whose acquisitions include Telerik, maker of the Fiddler debugging proxy, the Kemp load balancer line, and the MOVEit managed file transfer product.
Progress is not a name most practitioners would recognise, and most of them use something it owns. Through acquisition it holds Telerik, and with it Fiddler, the debugging proxy that generations of developers learned to read HTTP with; the Kemp load balancer line, which has its own entry here; and MOVEit, a managed file transfer product used by governments, banks and hospitals to move exactly the files they most need to move securely.
That last one is why the company belongs in this catalogue. Over the American Memorial Day weekend of 2023 - a holiday chosen, on the evidence, because defenders respond slowest then - the CL0P group exploited a previously unknown SQL injection flaw in MOVEit Transfer's web application, catalogued as CVE-2023-34362. The flaw let an unauthenticated attacker reach the database. The group installed a web shell called LEMURLOOT and used it to enumerate and exfiltrate whatever the server held. Progress published its advisory on 31 May; exploitation had been observed from 27 May. A second flaw in the same code was found and patched days later.
The reported scale is what makes it a landmark: over two thousand seven hundred organisations and the personal data of more than ninety-five million people, from a single vulnerability in a single product. And the crucial detail is in the government advisory rather than the coverage: the same actor had run zero-day campaigns against Accellion's file transfer appliance in 2020 and 2021, and against Fortra's GoAnywhere in early 2023. Managed file transfer was not chosen at random. It is the category where organisations concentrate their most sensitive outbound data, usually on an internet-facing server, frequently operated by a team that thinks of it as plumbing.
For a practitioner the lesson is about category rather than vendor. A product whose entire purpose is to hold sensitive files and be reachable from outside is a target of a specific kind, and the question to ask of it is not whether the vendor is careful but what happens when - not if - a pre-authentication flaw is found in it. That is the argument the perfect-code article makes, and MOVEit is its clearest single illustration.
- CISA advisory AA23-158A, #StopRansomware: in May 2023 the CL0P ransomware group, also known as TA505, exploited a previously unknown SQL injection vulnerability, CVE-2023-34362, in Progress Software's managed file transfer solution MOVEit Transfer, infecting internet-facing web applications with a web shell named LEMURLOOT and using it to steal data from the underlying databases; the same actor had conducted zero-day campaigns against Accellion File Transfer Appliance devices in 2020 and 2021 and Fortra GoAnywhere servers in early 2023
- Progress Software's own advisory of 31 May 2023: a SQL injection vulnerability in the MOVEit Transfer web application could allow an unauthenticated attacker to gain access to the database and execute statements that alter or delete elements; all versions before the five listed are affected, including older unsupported versions; exploitation of unpatched systems can occur over HTTP or HTTPS
- Akamai's analysis: Progress began warning customers on 31 May 2023; Mandiant observed exploitation attempts as early as 27 May; Microsoft attributed the campaign on 2 June and the group confirmed it on 5 June; the actor is financially motivated and extorts by data exfiltration rather than encryption
- Rapid7's running analysis: on 9 June 2023 Progress released new versions of MOVEit Transfer to fix a second vulnerability found in the same code, later designated CVE-2023-35036
- Reported scale of the campaign: over 2,700 organisations compromised and data on more than 95 million individuals exposed, with the exploitation carried out over a United States holiday weekend before the patch was released