Security News > 2020 > April > Hackers Mount Zero-Day Attacks on Sophos Firewalls
Attackers have been targeting the Sophos XG Firewall using a zero-day exploit, according to the security firm - with the ultimate goal of dropping the Asnarok malware on vulnerable appliances.
Firewalls manually configured to expose a firewall service to the WAN zone that shares the same port as the admin or user portal were also affected," the firm explained.
If hackers were able to access an exposed XG device, the Asnarok trojan was then installed, which is designed to exfiltrate data housed on the XG firewall itself.
"The data exfiltrated for any impacted firewall includes all local usernames and hashed passwords of any local user accounts," Sophos noted.
Asnarok first retrieves the public-facing IP address where the firewall was installed, using public search engines like "Ifconfig.me" and "Checkip.dyndns.org." Next, it retrieves information about the firewall and its users from different storage areas on the firewall.
News URL
https://threatpost.com/hackers-zero-day-attacks-sophos-firewalls/155169/
Related news
- U.S. Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls (source)
- Palo Alto Networks patches two firewall zero-days used in attacks (source)
- US names Chinese national it alleges was behind 2020 attack on Sophos firewalls (source)
- North Korean govt hackers linked to Play ransomware attack (source)
- Hackers target critical zero-day vulnerability in PTZ cameras (source)
- Sophos reveals 5-year battle with Chinese hackers attacking network devices (source)
- Sophos Versus the Chinese Hackers (source)
- Custom "Pygmy Goat" malware used in Sophos Firewall hack on govt network (source)
- Google fixes two Android zero-days used in targeted attacks (source)
- Hackers increasingly use Winos4.0 post-exploitation kit in attacks (source)