Сlarity and Trust – We take pride in being the site where you can feel free to express your opinion and leave feedback. Whenever you click on the websites of products reviewed by us, we participate in the revenue sharing and get commissions that help us maintain our project. Read more about how we work.

Malwarebytes suffered from hackers that arranged SolarWinds attack

Now Reading
Malwarebytes suffered from hackers that arranged SolarWinds attack

Malwarebytes cybersecurity company representatives said that although the company did not use SolarWinds products, it suffered from the same attackers who launched the SolarWinds attack. Cybercriminals managed to gain access to internal Malwarebytes emails.

Thus, the list of companies affected by hackers who compromised SolarWinds continues to grow.

Let me remind you that the attack on SolarWinds is attributed to a Russian-speaking hack group that information security experts track under the names StellarParticle (CrowdStrike), UNC2452 (FireEye) and Dark Halo (Volexity). Russian government hackers also attacked FireEye, the largest provider of information security solutions.

In a statement, Malwarebytes emphasizes that the incident is not related to the recent SolarWinds supply chain attack and hack. However, the same attackers hacked into Malwarebytes’ internal systems using a dormant security product in the Office 365 email client. The experts say that the attackers used an old vulnerability in Azure Active Directory to attack and ended up making API calls to retrieve emails via MSGraph.

“Despite the fact that Malwarebytes does not use SolarWinds products, we, like many other companies, were recently attacked by the same attacker. We can confirm the existence of another attack vector that abuses applications with privileged access to Microsoft Office 365 and Azure environments”, — the company said.

The attack was detected on December 15, 2020, and Malwarebytes learned about the incident from Microsoft specialists, who noticed suspicious activity emanating from a dormant security application. The fact is that then it became known about the compromise of SolarWinds, and Microsoft checked its infrastructure (including Office 365 and Azure) in search of traces of malicious applications created by hackers who compromised SolarWinds.

After the hack was discovered, Malwarebytes conducted an internal review and reported:

“After careful investigation, we determined that the attacker only gained access to a limited number of internal company emails.”

As in the case of SolarWinds attackers injected malware into one of the affected company’s products (the Orion platform, designed for centralized monitoring and management, was provided with a malicious update), Malwarebytes representatives emphasize that a thorough audit of all products and their source code was carried out, but during these checks was not discovered any evidence of unauthorized access or hack.

It is reported that the company’s software is safe and can be used further.

Let me remind you that the US Department of Justice suffered from attack on SolarWinds.

What's your reaction?
Love It
Like It
Want It
Had It
Hated It
About The Author
Vladimir Krasnogolovy
Leave a response

Leave a Response