TeamViewer's corporate network was breached this week in an attack that the remote access software vendor attributed to Russian state-sponsored threat actor Midnight Blizzard.
The company wrote at the time that it immediately began an investigation and would, in the interest of transparency, share more details as they became available.
Remote access software is often misused by threat actors for lateral movement in victim environments.
In 2021, a threat actor abused TeamViewer to gain access to SCADA systems at a water treatment plant in Oldsmar, Fla.
TeamViewer provided additional details Friday as an update to the initial statement.
TeamViewer attributed the attack to Midnight Blizzard, the Russian state-sponsored actor also known as APT29 and Cozy Bear.
Midnight Blizzard was behind the Microsoft breach disclosed earlier this year as well as the devastating 2020 supply chain attack against SolarWinds.
TeamViewer emphasized in the update that based on current evidence, its product environment and customer data were unaffected by the breach.
The updated statement explained that TeamViewer uses a defense-in-depth approach that limited the threat actor's ability to gain access to other parts of the company's environment.
TechTarget Editorial asked TeamViewer how the employee credentials were stolen, but a spokesperson declined to comment, promising more details as they become available.
The next update is expected by the end of business on Friday, Central European Summer Time.
Alexander Culafi is a senior information security news writer and podcast host for TechTarget Editorial.
This Cyber News was published on www.techtarget.com. Publication date: Fri, 28 Jun 2024 19:13:05 +0000