Cyber Defense eMagazine December 2019

106
The Threat Lab team also analyzed an MSP attack that targeted a specific piece of IT management
software. In this attack, the perpetrator leveraged weak, stolen or leaked credentials to gain
administrative access to the MSP’s copy of this management tool. From there, the attackers targeted
exposed remote management services. Once in, they exploited the MSPs’ own tools to infect their
customer base. Based on this and other MSP attacks from Q2 and Q1 2019, it is clear attackers are
specifically targeting MSPs to reach their customer bases. This attack could have been prevented with
better password security (since the attacker leveraged a legitimate admin password), user training or use
of multi-factor authentication.
What Are Some Key Lessons From Q2’19?
In summary, no target is too small. It’s no longer a matter of “if,” but “when” a target will get hacked.
Remember, many attacks can be thwarted simply by deploying authentication and MFA solutions
(specifically, MSPs should be hardening their management tools with MFA). Furthermore, due to the
increased sophistication of ransomware attacks, backup solutions should be mandatory. And don’t simply
create backups – test and verify them. As an extra precaution, use URL and domain filtering services to
help defang malicious links. Above all, implement effective user training to help employees recognize
and respond to phishing and ransomware attacks. The stakes are higher than ever before, and user
training should be at the forefront of any organization’s standard operating procedure.
About the Author
Emil Hozan is a Security Analyst at WatchGuard Technologies, focused on
network security. Emil’s responsibilities include quantifying threat data for
WatchGuard’s quarterly Internet Security Report, contributing to
WatchGuard’s security blog Secplicity, analyzing trends in network and
malware attacks, sandboxing and testing new products and exploits, and
reverse engineering malware samples
Emil can be reached online at https://www.secplicity.org/author/ehozan/ and
at our company website https://www.watchguard.com/.