Hackers target MSPs to launch ‘supply chain’ ransomware attacks

Kaseya and Webroot blame customers’ poor cyber security hygiene for letting attackers into their systems

Cyber attack on company

Businesses are being infiltrated by cyber criminals who are actively exploiting weak account credentials to gain access to systems installed by managed service providers (MSPs) and launch ransomware attacks.

Hackers have targeted customers via the remote monitoring and management tools provided by at least two companies, Webroot and Kaseya, in order to deploy the Sodinokibi malware, according to reports via Reddit.

Further investigation by security company Huntress Labs uncovered that MSPs were being targeted with the ransomware by exploiting remote desktop protocol (RDP) for initial access.

In two incidents, after gaining admin privileges the attackers then uninstalled Webroot and ESET software, as well as endpoint-based backup Veeam.

In another report, the firm found that Webroot's management console was used to execute a PowerShell based payload to download additional malware. Kaseya's VSA was also used to deliver Sodinokibi in a separate incident.

The scale of the incident is not fully known, but Huntress Labs suggest it could affect thousands of clients. The affected MSP, which has not been named publicly, is being offered technical assistance from Huntress Lab's CEO.

UBX Cloud, the company which originally created a thread about these reports, described the situation as "insanity" and suggested several Kaseya customers were affected according to a conference call.

Both Webroot and Kaseya have confirmed a portion of their customers have been infiltrated by threat actors, and have pointed the finger at inconsistent and lax password management. The integrity of their own products has apparently not been affected.

"We all know that two-factor authentication (2FA) is a cyber hygiene best practice, and we've encouraged customers to use the Webroot Management Console's built-in 2FA for some time," Webroot's senior vice president of products Chad Bacher said on Reddit.

"Recently, Webroot's Advanced Malware Removal team discovered that a small number of customers were impacted by a threat actor exploiting a combination of customers' weak cyber hygiene practices around authentication and RDP."

The company has decided, as a result, to initiate a console logout for those using its tools and release a software update that enables 2FA by default across all clients.

"We are aware of limited instances where customers were targeted by threat actors who leveraged compromised credentials to gain unauthorized access to privileged resources," Kaseya CTO John Durant told Dark Reading.

"All available evidence at our disposal points to the use of compromised credentials."

The rise of such supply chain cyber attackers were previously flagged by a National Cyber Security Centre (NCSC) report released last year. A large number of MSPs were subject to attacks in 2017, with the report suggesting when done well, these compromises are extremely difficult and sometimes impossible to detect.

Featured Resources

Security analytics for your multi-cloud deployments

IBM Security QRadar SIEM solution brief

Download now

Five reasons to move to the cloud

Join the enterprises moving their workloads to the cloud

Download now

Architecting hybrid IT and edge for digital advantage

Why business leaders should consider a hybrid IT strategy

Download now

Six reasons to accelerate remote asset monitoring with AI

How to optimise resources, increase productivity, and grow profit margins with AI

Download now

Recommended

10,000 emails hit with fake FedEx and DHL phishing attacks
phishing

10,000 emails hit with fake FedEx and DHL phishing attacks

24 Feb 2021
Cyber security firm saw attacks rise by 20% during 2020
cyber security

Cyber security firm saw attacks rise by 20% during 2020

23 Feb 2021
What to look for in a secure cloud system
cloud security

What to look for in a secure cloud system

23 Feb 2021
Hackers are using Google Alerts to help spread malware
hacking

Hackers are using Google Alerts to help spread malware

22 Feb 2021

Most Popular

Mysterious Silver Sparrow malware hits 30,000 macOS devices
malware

Mysterious Silver Sparrow malware hits 30,000 macOS devices

22 Feb 2021
IBM reportedly mulls sale of Watson Health business
mergers and acquisitions

IBM reportedly mulls sale of Watson Health business

22 Feb 2021
Microsoft to launch standalone Office 2021 suite
Microsoft Office

Microsoft to launch standalone Office 2021 suite

19 Feb 2021