Security News > 2020 > April > Hackers Mount Zero-Day Attacks on Sophos Firewalls
Attackers have been targeting the Sophos XG Firewall using a zero-day exploit, according to the security firm - with the ultimate goal of dropping the Asnarok malware on vulnerable appliances.
Firewalls manually configured to expose a firewall service to the WAN zone that shares the same port as the admin or user portal were also affected," the firm explained.
If hackers were able to access an exposed XG device, the Asnarok trojan was then installed, which is designed to exfiltrate data housed on the XG firewall itself.
"The data exfiltrated for any impacted firewall includes all local usernames and hashed passwords of any local user accounts," Sophos noted.
Asnarok first retrieves the public-facing IP address where the firewall was installed, using public search engines like "Ifconfig.me" and "Checkip.dyndns.org." Next, it retrieves information about the firewall and its users from different storage areas on the firewall.
News URL
https://threatpost.com/hackers-zero-day-attacks-sophos-firewalls/155169/
Related news
- Palo Alto Networks patches two firewall zero-days used in attacks (source)
- Rackspace monitoring data stolen in ScienceLogic zero-day attack (source)
- North Korean Hackers Using New VeilShell Backdoor in Stealthy Cyber Attacks (source)
- Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure (source)
- Qualcomm patches high-severity zero-day exploited in attacks (source)
- Ivanti warns of three more CSA zero-days exploited in attacks (source)
- Mozilla fixes Firefox zero-day actively exploited in attacks (source)
- Firefox Zero-Day Under Attack: Update Your Browser Immediately (source)
- CISA Adds ScienceLogic SL1 Vulnerability to Exploited Catalog After Active Zero-Day Attack (source)
- Hackers exploit 52 zero-days on the first day of Pwn2Own Ireland (source)