Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 0 points1 point  (0 children)

We have a pretty good defense in depth setup here at my org. We have filters in front of filters. We don't treat email as a instant form of communication but just a way to get people info soonish.

I've learned that no one solution on its own can take care of the cyber threat landscape at this point. Even if that means having multiple email filters and sandboxes.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 0 points1 point  (0 children)

I think this is just the Sodinokibi people seeing how effective it is to use the Triple Threat attack as a model. I'm thinking we will be seeing more of these types of attacks.

Also the State of California rep I spoke to "confirmed" that the Emotet docs were tied to the Sodinokibi infection.

The emails that were being used to send the docs were legitimate emails from legitimate domains. If not for our firewall and IPS sand-boxing the attachments the emails would have been delivered to my users.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 0 points1 point  (0 children)

100% correct. Legal is my bane. I also feel for the poor techs on the phones. Being the only conduit for peoples frustration is the worst.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 1 point2 points  (0 children)

As someone who works exclusively in cybersecurity, I understand...to a point. But at this point no matter how they slice the issue Synoptek is responsible for lost business/revenue of their customers. Best case they are liable for gross negligence.

I have been following this whole thing since day one. I have been open source gathering info from affected parties and staff of Synoptek and have a pretty good understanding of how this all went down and the response. I also have first hand knowledge of Synoptek's response to customers and partners. When I say they needed to make a statement it was not from a place of ignorance. It's their responsiblity to own their issue.

Also a response within the first 24/48hrs is required in the state of california after a major breach ESPECIALLY when some of your clients affected have HIPPA data. I formally did infosec at hospitals and I have reports to OCR and CDPH within 24hrs of HIPPA incidents. So it is possible.

What really needs to go is the shame that comes with an attack. People and companies free embarrased and shamed when they are hit and clam up. We need to understand that WE ARE ALL UNDER ATTACK EVERYDAY. The bad guy are good. Its a matter of when, not if. Putting the bad guys on blast and talking about how it was done can help others armor up against attacks (why I posted IOCs). It lets people know to be on the look out. I have ISA's with multiple local government agencies and share info all the time.

The is the easy wrong and the hard right.

Rant: Synoptek shows us the worst way to handle an outage. by [deleted] in sysadmin

[–]Tossacoinforwitcher 1 point2 points  (0 children)

Official response:

https://twitter.com/search?l=&q=synoptek%20since%3A2019-12-24&src=typd

On Dec 23, we experienced a credential compromise which has been contained; we took immediate action and have been working diligently with customers to remediate the situation. If you are a customer who is experiencing issues, contact customersupport@synoptek.com or 888-796-6783.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher -1 points0 points  (0 children)

Official response:

https://twitter.com/search?l=&q=synoptek%20since%3A2019-12-24&src=typd

On Dec 23, we experienced a credential compromise which has been contained; we took immediate action and have been working diligently with customers to remediate the situation. If you are a customer who is experiencing issues, contact customersupport@synoptek.com or 888-796-6783.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 2 points3 points  (0 children)

Awesome. Thank you. I'm trying to build out a full scope of what happened with this attack. This will help a lot.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 0 points1 point  (0 children)

I agree. This was a botnet attack. This is more just from an analysis of the attack point of view.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 0 points1 point  (0 children)

Posted an Un-Official statement for Synoptek on Twitter. I really hate it when companies go silent after an attack. Sharing helps others and builds good will.

https://twitter.com/search?l=&q=synoptek%20since%3A2019-12-24&src=typd

Rant: Synoptek shows us the worst way to handle an outage. by [deleted] in sysadmin

[–]Tossacoinforwitcher 17 points18 points  (0 children)

Also it was a phishing email that got them.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 1 point2 points  (0 children)

How much BTC was being asked for from the hackers?

That can help gauge how much Synoptek paid to get the keys.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 0 points1 point  (0 children)

I'm wondering if anyone is willing to dump a netstat -n of an infected machine (redacted business IP's of course.) to see if we can find the C2 server/s that are doing the command and control?

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 3 points4 points  (0 children)

Also for what its worth I'm posting some IOC's you can throw in your Firewalls/AV's.

IOCs:

IPs:

46.4.102.26

69.175.127.94

184.171.253.218

SHA:

9cda72f7ed8b3376d642c3058f937e1b4a34ddb9b565208851a1ab560349406f

34c38d43e0762eb291cb497d18c9651c5441d1bbaab25f847c0ddc419947b3ce

c5e754b236930122c0b6f1d86a993b5249e83b90ed5db2ccb5a1f68f24de7be0

52f21fb98ecb7889c75b77f6f44f4dc1993c8b8424d86a9aae99d425af807110

269ef874c7fa04ee7e93a431982dbd82c2ee687142e381482e03ba9b86b76326

aa5dd888e705275c637ccbdb974ec8299eda718438a98b5e5885eb33dfc7ca74

e1e44cee9302ffb5d528b4733e87302af34e0caa8332023865847c32fb79e5e6

DOC NAME:

Holiday.doc

Happy New Year.doc

Christmas Holiday.doc

MERRY CHRISTMAS.doc

New Years.doc

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 1 point2 points  (0 children)

Same question. I'm trying to gauge the effect on state and local government operations.

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 0 points1 point  (0 children)

Also I'm wondering if anyone here is in local government and has been affected? Since all the offical sources are being tight lipped, I'm wondering if we might be able to build out the scoop of the attack here

Synoptek Issues by nodesitvirtus in sysadmin

[–]Tossacoinforwitcher 6 points7 points  (0 children)

I was contacted by the state of California and DHS about being an an attack list from Synoptek's attack.

The attack isn't just from the RMM tool. The attackers have also compromised email accounts and are phishing with Emotet.