Security News > 2020 > April > Hackers Mount Zero-Day Attacks on Sophos Firewalls
Attackers have been targeting the Sophos XG Firewall using a zero-day exploit, according to the security firm - with the ultimate goal of dropping the Asnarok malware on vulnerable appliances.
Firewalls manually configured to expose a firewall service to the WAN zone that shares the same port as the admin or user portal were also affected," the firm explained.
If hackers were able to access an exposed XG device, the Asnarok trojan was then installed, which is designed to exfiltrate data housed on the XG firewall itself.
"The data exfiltrated for any impacted firewall includes all local usernames and hashed passwords of any local user accounts," Sophos noted.
Asnarok first retrieves the public-facing IP address where the firewall was installed, using public search engines like "Ifconfig.me" and "Checkip.dyndns.org." Next, it retrieves information about the firewall and its users from different storage areas on the firewall.
News URL
https://threatpost.com/hackers-zero-day-attacks-sophos-firewalls/155169/
Related news
- Fortinet Warns of New Zero-Day Used in Attacks on Firewalls with Exposed Interfaces (source)
- Hackers exploit KerioControl firewall flaw to steal admin CSRF tokens (source)
- Ivanti warns of new Connect Secure flaw used in zero-day attacks (source)
- Ivanti zero-day attacks infected devices with custom malware (source)
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- Miscreants 'mass exploited' Fortinet firewalls, 'highly probable' zero-day used (source)
- Fortinet warns of auth bypass zero-day exploited to hijack firewalls (source)
- Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (source)
- Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day (source)
- 48,000+ internet-facing Fortinet firewalls still open to attack (source)