CyberNews Briefs

Ransomware gang hacks MSPs to deploy ransomware on customer systems

Threat actors recently obtained unauthorized access to the networks of three managed service providers (MSPs) and subsequently targeted customers of the compromised firms with ransomware using SecureAnywhere, an MSP tool by Webroot designed for the remote monitoring and management of client machines. The ransomware used in the attack is dubbed Sodinokibi.

The attackers gained an initial foothold on the MSP networks by targeting Internet-facing Remote Desktop Protocol (RDP) services. In response to the attack, Webroot has started to enforce two-factor authentication (2FA) for SecureAnywhere accounts in order to make it harder for attackers to take advantage of the tool.

Ransomware groups are increasingly going after MSPs in order to target many customers at once. Earlier this year, 1,500 to 2,000 devices were infected with ransomware after attackers breached the systems of a single MSP.

Read more: Ransomware gang hacks MSPs to deploy ransomware on customer systems

OODA Analyst

OODA Analyst

OODA is comprised of a unique team of international experts capable of providing advanced intelligence and analysis, strategy and planning support, risk and threat management, training, decision support, crisis response, and security services to global corporations and governments.