Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Backoff and Citadel Abuse Remote Access Tools

Summary: Trusteer reported that a new Citadel variant, which has long used VNC for remote control, began adding new credentials to infected systems and enabling Windows RDP so attackers retain access after the Citadel infection is removed. The same week, US-CERT alert TA14-212A described how actors used publicly available tools to find organizations with insecurely configured remote access applications, then ran brute force attacks against credentials to gain access, install implants, and exfiltrate consumer payment data.

What's compelling: Backoff operators turned weak remote access into stolen consumer payment data, and Citadel's RDP switch means an attacker can keep control of a machine even after the malware is cleaned - while RDP traffic blends in with what administrators use every day.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Related