What initially appeared to be just normal maintenance activity on Anydesk’s infrastructure was later revealed to actually be a compromise.
AnyDesk has in fact made the situation official in a communication published on February 2 on its institutional website. As specified in the communication, the compromise concerned production servers and the consequence was the need to generate new certificates with which to sign AnyDesk executables.
How to react to this compromise?
As indicated by AnyDesk, it is essential to install the latest available version of the software, signed with the new certificates. From a detection point of view, it’s also important to check whether any compromised versions of AnyDesk may be running in your environments. To do this, you can use the Yara rule made available by Florian Roth, which has already detected a compromised version on VirusTotal.
During the last week of April, our Attacker Centric SOC detected multiple new cyber attacker group websites in the Dark Web. Called Dedicated Leak Sites (DLS), they are widely used by ransomware gangs to publish stolen confidential data when the victim Read More
Cisco Talos identified a previously unknown state-sponsored actor behind ArcaneDoor, a sophisticated cyber espionage campaign targeting the perimeter network devices of several vendors. This actor is now tracked as UAT4356 by Talos and STORM-1849 by the Microsoft Threat Intelligence Center. The Read More
Using our CTI SATAYO platform, we identified an artifact belonging to AMMEGA's data breach. AMMEGA is a multinational manufacturing company based in the Netherlands with revenues of $1.2 billion. It was the victim of an attack carried out by the Read More
On March 25, 2024, the Cybersecurity & Infrastructure Security Agency (CISA) added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The catalog is updated regularly and contains those vulnerabilities most likely to be used in attacks. Organizations should monitor Read More
On March 4, 2024, JetBrains released TeamCity version 2023.11.4, which patches two authentication bypass vulnerabilities in the web component of TeamCity. These vulnerabilities were discovered in February by Rapid7’s vulnerability research team and allow a remote unauthenticated attacker to perform Read More