Hackers target MSPs to launch ‘supply chain’ ransomware attacks

Kaseya and Webroot blame customers’ poor cyber security hygiene for letting attackers into their systems

Businesses are being infiltrated by cyber criminals who are actively exploiting weak account credentials to gain access to systems installed by managed service providers (MSPs) and launch ransomware attacks.

Hackers have targeted customers via the remote monitoring and management tools provided by at least two companies, Webroot and Kaseya, in order to deploy the Sodinokibi malware, according to reports via Reddit.

Advertisement - Article continues below

Further investigation by security company Huntress Labs uncovered that MSPs were being targeted with the ransomware by exploiting remote desktop protocol (RDP) for initial access.

In two incidents, after gaining admin privileges the attackers then uninstalled Webroot and ESET software, as well as endpoint-based backup Veeam.

In another report, the firm found that Webroot's management console was used to execute a PowerShell based payload to download additional malware. Kaseya's VSA was also used to deliver Sodinokibi in a separate incident.

The scale of the incident is not fully known, but Huntress Labs suggest it could affect thousands of clients. The affected MSP, which has not been named publicly, is being offered technical assistance from Huntress Lab's CEO.

UBX Cloud, the company which originally created a thread about these reports, described the situation as "insanity" and suggested several Kaseya customers were affected according to a conference call.

Both Webroot and Kaseya have confirmed a portion of their customers have been infiltrated by threat actors, and have pointed the finger at inconsistent and lax password management. The integrity of their own products has apparently not been affected.

Advertisement - Article continues below

"We all know that two-factor authentication (2FA) is a cyber hygiene best practice, and we've encouraged customers to use the Webroot Management Console's built-in 2FA for some time," Webroot's senior vice president of products Chad Bacher said on Reddit.

"Recently, Webroot's Advanced Malware Removal team discovered that a small number of customers were impacted by a threat actor exploiting a combination of customers' weak cyber hygiene practices around authentication and RDP."

The company has decided, as a result, to initiate a console logout for those using its tools and release a software update that enables 2FA by default across all clients.

"We are aware of limited instances where customers were targeted by threat actors who leveraged compromised credentials to gain unauthorized access to privileged resources," Kaseya CTO John Durant told Dark Reading.

"All available evidence at our disposal points to the use of compromised credentials."

The rise of such supply chain cyber attackers were previously flagged by a National Cyber Security Centre (NCSC) report released last year. A large number of MSPs were subject to attacks in 2017, with the report suggesting when done well, these compromises are extremely difficult and sometimes impossible to detect.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download
Advertisement

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
Cyber attacks on manufacturing up 300% in a year
Security

Cyber attacks on manufacturing up 300% in a year

11 May 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021