Webroot Statement About Ransomware Attacks: No Breach, No Product Compromise
In a statement to MSSP Alert, Webroot was quick to assure MSPs that the company "was not breached and our products were not compromised."
"We all know that two-factor authentication (2FA) is a cyber hygiene best practice, and we’ve encouraged customers to use the Webroot Management Console’s built-in 2FA for some time.
Recently, Webroot’s Advanced Malware Removal team discovered that a small number of customers were impacted by a threat actor exploiting a combination of customers’ weak cyber hygiene practices around authentication and RDP.
To ensure the best protection for the entire Webroot customer community, we decided it is time to make two-factor authentication mandatory. We did this by conducting a console logout and software update the morning of June 20.
We are always closely monitoring the threat environment, and will continue to take proactive measures like this to provide the best protection possible for customers."
Kaseya Statement About Ransomware Attacks: Compromised Credentials to Blame
"We are aware of limited instances where customers were targeted by threat actors who leveraged compromised credentials to gain unauthorized access to privileged resources. All available evidence at our disposal points to the use of compromised credentials. We continue to monitor the situation very closely.
The industry continues to see MSPs and IT administrators as targets in order to gain credentials for unauthorized access. And, the research is clear: no matter what the system or software worldwide, 80% of security breaches involve compromised credentials. As we’ve investigated recent instances experienced by customers, all available evidence to us points to the use of compromised credentials to gain unauthorized access. We work diligently to prevent the misuse of our products and continue to urge customers to employ best practices around securing their credentials, regularly rotating passwords, and strengthening their security hygiene. In short, leaders in the industry like Kaseya are constantly raising the bar of security practices and processes as the Internet threat landscape ceaselessly evolves. And, we’ll continue to help our customers through training, educational materials, and other assistance to employ these practices."
Huntress Labs Investigates MSP Software Attacks
"We are not sure exactly how many MSPs are compromised. We are aware of three independently compromised MSPs in the past 72hrs, but we cannot guarantee they are directly related (although they share many similarities).
We’ve been told up to 200 hosts were successfully encrypted which is a very small number compared to the number of hosts managed by these three MSPs.
We’re not certain how the attackers gained access to Webroot or Kaseya VSA in these incidents. Considering how many MSPs use Webroot/Kaseya, we'd expect there to be way more chatter from affected MSPs if there was a new vulnerability affecting all Webroot/Kaseya customers. We suspect the incidents were the result of compromised MSP user credentials, but we're not ruling our other possibilities. We’ll definitely share more if we learn otherwise."
