Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/20/2019
06:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Customers of 3 MSPs Hit in Ransomware Attacks

Early information suggests threat actors gained access to remote monitoring and management tools from Webroot and Kaseya to distribute malware.

UPDATE: 06/21/2019 This story has been updated to reflect the fact that customers of at least three MSPs were impacted in the attacks, not just one MSP as previously reported.

Computers belonging to customers of at least three managed services providers have been hit with ransomware after attackers somehow gained access to tools used by the MSPs to remotely manage and monitor client systems.

Details of the attacks are still only emerging, and the full scope of the incidents or even the names of the MSPs are still not currently available. But early information suggests that attackers likely used two remote management tools at the MSPs — one from Webroot, the other from Kaseya — to distribute the ransomware. Both vendors have said the attackers appear to have used stolen credentials to access their tools at the MSP locations.

Comments on an MSP forum on Redditt, including from security researchers claiming close knowledge of the incidents, suggest one MSP is a large company and that many of its clients have been impacted.

A researcher from Huntress Labs, a firm that provides security services to MSPs, claimed on Reditt to have confirmation that the attackers used a remote management console from Webroot to execute a PowerShell based payload that in turn downloaded the ransomware on client systems. Webroot describes the console as allowing administrators to view and manage devices protected by the company's AV software.

According to the Huntress Labs researcher, the payload was likely 'Sodinokibi', a ransomware tool that encrypts data on infected systems and deletes shadow copy backups as well.

Kyle Hanslovan, CEO and co-founder of Huntress Lab says a customer of one MSP that was attacked, contacted his company Thursday and provided their Webroot management console logs for analysis.  "We don't know how the attacker gained access into the Webroot console," Hanslovan says.

But based on the timestamps, the Webroot console was used to download payloads onto all managed systems very quickly and possibly in an automated fashion. "This affected customer had 67 computers targeted by malicious PowerShell delivered by Webroot," Hanslovan says. "We're not sure how many computers were successfully encrypted by the ransomware."

What's also not clear is how the attackers are managing to gain access to the Webroot console so efficiently he says.  "We’ve yet to see anything that would suggest the issue is a global Webroot vulnerabilty." However, three MSP incidents in less than 48hrs involved compromised Webroot management console credentials, he notes.

One Reditt poster using the handle "Jimmybgood22" claimed Thursday afternoon that almost all of its systems were down. "One of our clients getting hit with ransomware is a nightmare, but all of our clients getting hit at the same time is on another level completely," Jimmybgood22 wrote.

Huntress Labs posted a copy of an email that Webroot purportedly sent out to customers following the incident, informing them about two-factor authentication (2FA) now being enforced on the remote management portal. The email noted that threat actors who might have been "thwarted with more consistent cyber hygiene" had impacted a small number of Webroot customers. The company immediately began working with the customers to remediate any impact.

Effective early morning June 20, Webroot also initiated an automated console logoff and implemented mandatory 2FA in the Webroot Management Console, the security vendor said.  Chad Bacher, sebior vice president of products at Webroot says the comapny's product has not been compronised. "We all know that two-factor authentication (2FA) is a cyber hygiene best practice, and we’ve encouraged customers to use the Webroot Management Console’s built-in 2FA for some time," Bacher says.

Meanwhile, another researcher with UBX Cloud, a firm that provides triage and consulting services to MSPs, claimed on Reditt to have knowledge that the attacker had leveraged a remote monitoring and management tool from Kaseya to deliver the ransomware.

"Kaseya was the only common touch point between the MSPs clients and it is obvious that the delivery method leveraged Kaseya's automation by dropping a batch file on the target machine and executing via agent procedure or PowerShell," the researcher claimed. As with the Webroot console, the MSP did not appear to have implemented 2FA for accessing the Kaseya console.

In emailed comments, John Durant, CTO at Kaseya, confirmed the incident."We are aware of limited instances where customers were targeted by threat actors who leveraged compromised credentials to gain unauthorized access to privileged resources," Durant says. "All available evidence at our disposal points to the use of compromised credentials."

In February, attackers pulled off an almost identical attack against another US-based MSP. In that incident, between 1,500 and 2,000 computers belonging to the MSP's customers were simultaneously encrypted with GandCrab ransomware. Then, as now, the attackers are believed to have used Kaseya's remote monitoring and management tool to distribute the malware.

MSPs and IT administrators continue to be targets for attackers looking to gain credentials for unauthorized access, Durant says. "We continue to urge customers to employ best practices around securing their credentials, regularly rotating passwords, and strengthening their security hygiene," he says.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
New FISMA Report Shows Progress, Gaps in Federal Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/21/2019
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15513
PUBLISHED: 2019-08-23
An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) as used on Motorola CX2L MWR04L 1.01 and C1 MWR03 1.01 devices. /tmp/.uci/network locking is mishandled after reception of a long SetWanSettings command, leading to a device hang.
CVE-2019-15504
PUBLISHED: 2019-08-23
drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffic (which may be remote via usbip or usbredir).
CVE-2019-15505
PUBLISHED: 2019-08-23
drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).
CVE-2019-15507
PUBLISHED: 2019-08-23
In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. Th...
CVE-2019-15508
PUBLISHED: 2019-08-23
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 5.0.1. The fi...