June 28th, 2024

TeamViewer confirms Russian spies hacked its corporate network

TeamViewer confirmed a breach by Russian state-sponsored hackers on June 26, 2024, contained within their Corporate IT environment. APT29, or Cozy Bear, was attributed to the attack. Organizations using TeamViewer should stay alert.

Read original articleLink Icon
TeamViewer confirms Russian spies hacked its corporate network

TeamViewer, a remote access software provider, confirmed that Russian state-sponsored hackers breached its corporate network on June 26, 2024. The attack was attributed to APT29, also known as Midnight Blizzard or Cozy Bear. TeamViewer stated that the breach was contained within their Corporate IT environment and did not extend to their product environment or customer data. The company emphasized its defense-in-depth approach to prevent unauthorized access between different environments. This confirmation followed earlier reports and speculations about the incident, with security experts already suspecting APT29's involvement. Health-ISAC had issued an alert attributing the attack to APT29 before TeamViewer's confirmation, advising organizations to monitor for unusual activity. TeamViewer committed to transparent communication and engaged IT security experts for the investigation. Given TeamViewer's widespread use across industries like healthcare and finance, organizations using the software should remain vigilant for signs of unauthorized access.

Related

Chinese Hackers Have Stepped Up Attacks on Taiwanese Organizations

Chinese Hackers Have Stepped Up Attacks on Taiwanese Organizations

A cybersecurity firm identified RedJuliett, a suspected Chinese state-sponsored hacking group, targeting Taiwanese sectors. The group exploited VPN software vulnerabilities, raising tensions between China and Taiwan. Organizations are advised to enhance security measures.

Snowflake breach snowballs as more victims, perps, come forward

Snowflake breach snowballs as more victims, perps, come forward

The Snowflake data breach expands to include Ticketek, Ticketmaster, and Advance Auto Parts. ShinyHunters claim involvement, Snowflake enforces security measures. CDK faces ransomware attack, Juniper and Apple vulnerabilities identified. Jetflicks operators convicted.

MOVEit Transfer: Auth bypass and a look at exposure

MOVEit Transfer: Auth bypass and a look at exposure

Progress Software disclosed two critical authentication bypass CVEs affecting MOVEit Transfer and Gateway products on June 25, 2024. CVE-2024-5806 was upgraded from High to Critical. Censys reported 2,700 instances concentrated in the US, emphasizing ongoing vigilance.

Identity Verification Used by X, TikTok, and Uber Exposed Driver's Licenses

Identity Verification Used by X, TikTok, and Uber Exposed Driver's Licenses

An identity verification firm, AU10TIX, exposed login credentials, risking access to sensitive data like driver's licenses. Despite claims of prompt revocation, functional credentials were found. AU10TIX partners with major platforms.

TeamViewer Security Breach

TeamViewer Security Breach

TeamViewer detected an internal IT irregularity, investigating with cyber experts. No impact on product environment or customer data. Emphasis on security, transparency, and proactive measures to maintain trust and safety.

Link Icon 3 comments
By @jasonvorhe - 4 months
How convenient that they're this quick to find evidence of a Russian APT when attribution is usually one of the more difficult things to do well in IT security.
By @ilrwbwrkhv - 4 months
I wonder how much of this is because the software talent which joins TeamViewer or LastPass is of really poor quality.

I mean, is there any good engineer who actually wants to work for these companies?