Hackers target MSPs to launch ‘supply chain’ ransomware attacks

Kaseya and Webroot blame customers’ poor cyber security hygiene for letting attackers into their systems

Cyber attack on company

Businesses are being infiltrated by cyber criminals who are actively exploiting weak account credentials to gain access to systems installed by managed service providers (MSPs) and launch ransomware attacks.

Hackers have targeted customers via the remote monitoring and management tools provided by at least two companies, Webroot and Kaseya, in order to deploy the Sodinokibi malware, according to reports via Reddit.

Advertisement - Article continues below

Further investigation by security company Huntress Labs uncovered that MSPs were being targeted with the ransomware by exploiting remote desktop protocol (RDP) for initial access.

In two incidents, after gaining admin privileges the attackers then uninstalled Webroot and ESET software, as well as endpoint-based backup Veeam.

In another report, the firm found that Webroot's management console was used to execute a PowerShell based payload to download additional malware. Kaseya's VSA was also used to deliver Sodinokibi in a separate incident.

The scale of the incident is not fully known, but Huntress Labs suggest it could affect thousands of clients. The affected MSP, which has not been named publicly, is being offered technical assistance from Huntress Lab's CEO.

UBX Cloud, the company which originally created a thread about these reports, described the situation as "insanity" and suggested several Kaseya customers were affected according to a conference call.

Advertisement
Advertisement - Article continues below

Both Webroot and Kaseya have confirmed a portion of their customers have been infiltrated by threat actors, and have pointed the finger at inconsistent and lax password management. The integrity of their own products has apparently not been affected.

Advertisement - Article continues below

"We all know that two-factor authentication (2FA) is a cyber hygiene best practice, and we've encouraged customers to use the Webroot Management Console's built-in 2FA for some time," Webroot's senior vice president of products Chad Bacher said on Reddit.

"Recently, Webroot's Advanced Malware Removal team discovered that a small number of customers were impacted by a threat actor exploiting a combination of customers' weak cyber hygiene practices around authentication and RDP."

The company has decided, as a result, to initiate a console logout for those using its tools and release a software update that enables 2FA by default across all clients.

"We are aware of limited instances where customers were targeted by threat actors who leveraged compromised credentials to gain unauthorized access to privileged resources," Kaseya CTO John Durant told Dark Reading.

"All available evidence at our disposal points to the use of compromised credentials."

The rise of such supply chain cyber attackers were previously flagged by a National Cyber Security Centre (NCSC) report released last year. A large number of MSPs were subject to attacks in 2017, with the report suggesting when done well, these compromises are extremely difficult and sometimes impossible to detect.

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020
Mid-year report says vulnerabilities up 22% in 2020
hacking

Mid-year report says vulnerabilities up 22% in 2020

30 Jul 2020
BlackRock banking Trojan targets Android apps
trojans

BlackRock banking Trojan targets Android apps

27 Jul 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do I fix the Windows 10 Start Menu if it's frozen?
operating systems

How do I fix the Windows 10 Start Menu if it's frozen?

3 Aug 2020