Hackers target TeamViewer to try and get access to your company’s network
Poorly protected TeamViewer instances are being targeted once again
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers are back to using TeamViewer to breach computers and deployransomware, a new report from cybersecurity researchers Huntress is saying.
TeamViewer is one of the most popular remote access andremote desktopmanagement tools out there. It’s a legitimate piece of software broadly used in the enterprise world to allow users quick and seamless access to remote endpoints.
However, its popularity also means it is a popular target among hackers.
LockBit builder
Years ago, security experts warned that threat actors were targeting devices with TeamViewer to deploy ransomware. Back then, it was noted that TeamViewer itself was not vulnerable, and instead it was the users and their poor password hygiene that led to the attacks. By securing TeamViewer instances with easy-to-guess passwords, the victims allowed cybercriminals to access them via credential stuffing and brute-forcing.
Many people use the same username/password combination across multiple services. When one service gets breached, and the credentials leak, hackers can easily move into other services, too.
Now, Huntress is warning that some hackers are back to using this same attack vector. The researchers detailed two examples, both of which seem to have come from the same threat actor. While one endpoint was actively used by the company’s staff, the other one was left unattended for months, making it an ideal target for threat actors.
Luckily for the target companies, both attacks were unsuccessful - the first one was quickly contained, and the second one was prevented through antivirus software. That doesn’t mean the attackers were fully unsuccessful - other attempts, made elsewhere, might have been successful.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Huntress wasn’t able to identify the attackers, but claims the encryptors were similar to those created with the leaked LockBit Black builder.
The builder for LockBit 3.0 leaked more than a year ago,BleepingComputerreminds, after which two ransomware groups - Bl00dy and Buhti, used it to launch their own campaigns.
In a statement, TeamViewer said, “we take the security and integrity of our platform extremely seriously and unequivocally condemn any form of malicious use of our software.
Our analysis shows that most instances of unauthorized access involve a weakening of TeamViewer’s default security settings. This often includes the use of easily guessable passwords which is only possible by using an outdated version of our product. We constantly emphasize the importance of maintaining strong security practices, such as using complex passwords, two-factor-authentication, allow-lists, and regular updates to the latest software versions. These steps are critical in safeguarding against unauthorized access.”
“To further support our users in maintaining secure operations, we have published a set of best practices for secure unattended access, which can be found at [Best practices for secure unattended access - TeamViewer Support]. We strongly encourage all our users to follow these guidelines to enhance their security posture.”
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
The Apple Watch is helping Afib patients ditch blood thinners in a ground-breaking trial
