What happened

We are talking about the German program AnyDeskThis allows you to control one computer from another. The incident was detected after a security audit and is not a ransomware attack. But the company doesn’t say what its goal was at the time or exactly when it happened; Maybe because he doesn’t know.

It is not yet known whether any information was stolen as a result of the attack. However, the company emphasized that: There is no evidence that end user systems are affected.

Earlier this week, well-known programmer Gunther Born reported on his BornCity blog that the AnyDesk service has been under maintenance since January 29. The problem, unknown at the time, was resolved on February 1. Earlier on January 24, the company also warned users about “periodic timeouts” and “deterioration in service quality” via its customer portal.

AnyDesk has more than 170,000 customers, including Amedes, AutoForm Engineering, LG Electronics, Samsung Electronics, Spidercam and Thales. The program is also used by people who do not represent large companies.

The developers revoked all security-related certificates and took a number of measures to eliminate the consequences. The company is asking users to change their passwords and also download the latest version of the software, which comes with a new code signing certificate..

Did the hacker impersonate himself?

Meanwhile, an unknown person appeared on one of the criminal forums on the dark web and offered to buy the data allegedly stolen from AnyDesk. Cybersecurity company Resecurity said it had identified two attackers, one of whom used the pseudonym “Jobaaaaa”. It advertises that “a significant number of AnyDesk customer credentials are for sale, indicating they may be used for tech support scams and email (phishing).” 18,317 accounts with $15,000 in cryptocurrency.

Timestamps in the screenshots shared by the attacker indicate successful unauthorized access dated February 3, 2024, which occurred after the incident was reported in the media. Resecurity believes that because passwords can be reset, cybercriminals may rush to monetize existing customer credentials.