Hackers target MSPs to launch ‘supply chain’ ransomware attacks

Kaseya and Webroot blame customers’ poor cyber security hygiene for letting attackers into their systems

Cyber attack on company

Businesses are being infiltrated by cyber criminals who are actively exploiting weak account credentials to gain access to systems installed by managed service providers (MSPs) and launch ransomware attacks.

Hackers have targeted customers via the remote monitoring and management tools provided by at least two companies, Webroot and Kaseya, in order to deploy the Sodinokibi malware, according to reports via Reddit.

Further investigation by security company Huntress Labs uncovered that MSPs were being targeted with the ransomware by exploiting remote desktop protocol (RDP) for initial access.

In two incidents, after gaining admin privileges the attackers then uninstalled Webroot and ESET software, as well as endpoint-based backup Veeam.

In another report, the firm found that Webroot's management console was used to execute a PowerShell based payload to download additional malware. Kaseya's VSA was also used to deliver Sodinokibi in a separate incident.

The scale of the incident is not fully known, but Huntress Labs suggest it could affect thousands of clients. The affected MSP, which has not been named publicly, is being offered technical assistance from Huntress Lab's CEO.

UBX Cloud, the company which originally created a thread about these reports, described the situation as "insanity" and suggested several Kaseya customers were affected according to a conference call.

Both Webroot and Kaseya have confirmed a portion of their customers have been infiltrated by threat actors, and have pointed the finger at inconsistent and lax password management. The integrity of their own products has apparently not been affected.

"We all know that two-factor authentication (2FA) is a cyber hygiene best practice, and we've encouraged customers to use the Webroot Management Console's built-in 2FA for some time," Webroot's senior vice president of products Chad Bacher said on Reddit.

"Recently, Webroot's Advanced Malware Removal team discovered that a small number of customers were impacted by a threat actor exploiting a combination of customers' weak cyber hygiene practices around authentication and RDP."

The company has decided, as a result, to initiate a console logout for those using its tools and release a software update that enables 2FA by default across all clients.

"We are aware of limited instances where customers were targeted by threat actors who leveraged compromised credentials to gain unauthorized access to privileged resources," Kaseya CTO John Durant told Dark Reading.

"All available evidence at our disposal points to the use of compromised credentials."

The rise of such supply chain cyber attackers were previously flagged by a National Cyber Security Centre (NCSC) report released last year. A large number of MSPs were subject to attacks in 2017, with the report suggesting when done well, these compromises are extremely difficult and sometimes impossible to detect.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
Cyber attacks on manufacturing up 300% in a year
Security

Cyber attacks on manufacturing up 300% in a year

11 May 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
What is single sign-on (SSO)?
single sign-on (SSO)

What is single sign-on (SSO)?

2 Dec 2021