Experts warn of hacker claiming access to 50 U.S. companies through breached MSP

guest · Jul 29, 2022

July 28, 2022

Cybersecurity experts are raising concerns about an individual on a hacker forum claiming to have access to 50 American companies through an unnamed managed service provider (MSP).

MSPs are paid to manage IT infrastructure and provide support, typically by smaller organizations lacking their own IT departments. In recent years they have been singled out by cybersecurity agencies as potentially vulnerable access points for hackers to exploit.
Click to expand...

Harlan Carvey, senior incident responder at cybersecurity firm Huntress, told The Record that on July 18 someone with the handle “Beeper” had posted in Russian on exploit[.]in asking for help monetizing access to a managed service provider.

“Looking for a Partner for MSP processing. I have access to the MSP panel of 50+ companies. Over 100 ESXi, 1,000+ servers … I want to work qualitatively, but I do not have enough people,” the translated message said.
Click to expand...

Some online noted that Kansas City-based MSP NetStandard announced on Wednesday morning that their hosted environment had been hit by a cyberattack. The company did not respond to requests for comment but told customers they discovered the attack on Tuesday and are “working to isolate the threat and minimize impact.”

“MyAppsAnywhere services, which include Hosted GP, Hosted CRM, Hosted Exchange, and Hosted Sharepoint, will be offline until further notice,” the company said.
Click to expand...

guest · Jul 29, 2022

Kansas MSP shuts down cloud services to fend off cyberattack
July 27, 2022

A US managed service provider NetStandard suffered a cyberattack causing the company to shut down its MyAppsAnywhere cloud services, consisting of hosted Dynamics GP, Exchange, Sharepoint, and CRM services.
While the company says that only the MyAppsAnywhere services are affected, the attack appears to have had a broader impact, with the company's main site shut down as well.

As NetStandard is sharing no further details, it is unclear what type of attack has occurred. However, security researchers believe this is likely a ransomware attack, as we commonly see with cyberattacks like the one on NetStandard.
Click to expand...

A coincidence?
In what may be a coincidence, Huntress Lab's CEO Kyle Hanslovan tweeted a screenshot yesterday of a threat actor's looking for partners to conduct an attack on a managed service provider.
According to the post on the Russian-speaking Exploit hacking forum, the threat actor claims to have access to an MSP panel managing over 50 companies, 100 VMware ESXi servers, and 1000+ servers.

While it is unclear if this forum post is linked to the attack on NetStandard, it would not be far-fetched for a ransomware member to have contacted the threat actor to partner with them.
Click to expand...

Log in or Sign up

Experts warn of hacker claiming access to 50 U.S. companies through breached MSP

guest Guest

guest Guest

Log in or Sign up

Experts warn of hacker claiming access to 50 U.S. companies through breached MSP

guest Guest

guest Guest

Useful Searches