Hakerzy użyli Webroot SA do ataku szkodnikiem Sodinokibi

[ichito]

To niedobra wiadomość dla użytkowników produktów Webroot - wg informacji opublikowanej pierwotnie na Reddit hakerzy użyli zdalnych narzędzi do dystrybucji ransomware Sodinokibi za pomocą konsoli Webroot SecureAnywhere. Nieco więcej w cytacie

Threat actors behind Sodinokibi ransomware managed to hack into at least three managed service providers (MSPs) and used remote management tools to distribute the malicious malware payload via the Webroot SecureAnywhere console. The news came to light when Reddit user posted the revelation on the MSP message board.
Among other affected tools, reports claim that Kaseya VSA was also affected by the compromise and was used to deliver Sodinokibi ransomware.
After the compromise, attackers managed to deploy “1488.bat” script, which is very similar to the one used in GandCrab ransomware attacks, which also disabled the management console. Nevertheless, in Sodinokibi ransomware case, the source of the incident was compromised credentials rather than the vulnerability.

Hackers managed to breach through via the Remote Desktop
According to findings by Kyle Hanslovan, a CEO of security firm Huntress Lab, the hackers managed to breach MSPs servers with the help of Remote Desktop connection and then elevated their privileges to those of administrator's, which let them uninstall security applications, such as Webroot or ESET.
After disabling anti-malware software, threat actors remotely connected to MSPs clients' machines that ran Webroot SecureAnywhere console. This tool was then used to run PowerShell scripts and install the malicious Sodinokibi payload from Pastebin page, which was immediately removed upon the discovery (although non-malicious version was posted on Github).
According to the limited research that was conducted so far, it was discovered that Webroot is the most likely target since its console allows administrators to download and execute files on machines remotely. With hackers hijacking it, infecting users with malware becomes a much easier task.

Jak widać Eset też może być potencjalnie wykorzystany w tym ataku, ale nie ma sygnałów na ten temat. Webroot póki co poza oświadczeniem wysoce zaleca korzystanie z dostępnej teraz dwuetapowej weryfikacji przy logowaniu.

Poniżej źródło cytatu wraz linkami do dalszych źródeł w temacie

[Aby zobaczyć linki, zarejestruj się tutaj]