24. 05. 2024
SOCnews
TeamViewer, the popular remote access software developed by the company of the same name, discovered an irregularity in its internal IT environment on 26 June. They disclosed the potential breach in a statement the following day, stating that they had immediately begun an investigation to implement remediation measures.
In an update on Friday 28th, TeamViewer attributed the attack to the threat actor known as APT29 / Midnight Blizzard. APT29 is a state-sponsored threat actor known by many names, affiliated with the Russian Foreign Intelligence Service (SVR).
The latest findings confirm how the threat actor leveraged a compromised employee account to copy employee directory data such as names, corporate contact information, and encrypted employee passwords from the company’s internal IT environment. TeamViewer has strong internal network segregation in place, with the corporate IT environment completely isolated from the product environment. As a result, no customer data was affected during the incident.
Mirko Ioris
Technical Consultant - Cyber Security Team | Würth Phoenix
Author
