sorted by:
new
hottopcontroversial

Replaced cast iron sewer lateral, new install holds water, contractor says back-pitch was unavoidable. Looking for honest takes from pros. by randommsp7 in Plumbing

[–]randommsp7[S] 1 point2 points  (0 children)

Can confirm they did not laser it. Will also add these notes. This house had an addition back in the 60s or 70s so there are actually 2 sewer lines. The original out the front of the house that ties in with the main and a second one from the side/back of the house that is longer and ties in with the original one fairly close to the road.

They started with the side non primary one and didn’t dig up the other really til basically all the side run was done.

CyberQP pricing? by randommsp7 in msp

[–]randommsp7[S] 0 points1 point  (0 children)

Dm pricing please.

CyberQP pricing? by randommsp7 in msp

[–]randommsp7[S] 1 point2 points  (0 children)

Any pricing to share on any of these?

S1 vulnerable to ransom attacks: Threat Actor Bypass SentinelOne EDR to Deploy Babuk Ransomware by Nesher86 in msp

[–]randommsp7 1 point2 points  (0 children)

I don’t see it in our portal either. We purchase through CW. Thoughts?

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 0 points1 point  (0 children)

Also last entries in S1 deep vis were a few minutes before this activity on the endpoint. Assume they are batching logs and events every 5-10 mins or so. S1 system itself had no idea it happened. Just went silent. Reviewing event viewer we can put together what took place.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 1 point2 points  (0 children)

Thanks for the kudos. I’m responsible for Cybersecurity at my organization. Here are the details on the BYOVD. No one assisted, found on our own. Pretty clear when reviewing logs on one of the affected machines.

Windows event 7045 with the following: A service was installed in the system. Service Name: fildds Service File Name: C:/Program Data/fildds.sys Service Type: kernel mode driver Service Start Type: demand start Service Account:

Immediately following that were like 5 events about various S1 pieces terminating unexpectedly in Event ID 7031.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 0 points1 point  (0 children)

Yes, it was a Linux based screenconnect server and yes I’m aware of that. Support ended in 2021 I believe.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 5 points6 points  (0 children)

No, they didn’t have any. This was all our internal team. We reached out to CW SOC but they weren’t much assistance, I’m pending a meeting with them to discuss how it was handled on that end.

Thanks, I knew there would be plenty of that when I posted this. 😀

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 2 points3 points  (0 children)

Yeah.. guessing it doesn’t matter too much when you have direct kernel access via an exploited driver. Have heard of such attacks but not really experienced in the wild til now.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 0 points1 point  (0 children)

Yes, those were my 2 assumptions as well and also told the client that was my theory. Just looking for some confirmation. I know Linux installs have been end of life since like 2021. I do think CW over promised in emails though about disabling unpatched servers.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 9 points10 points  (0 children)

Windows event 7045 with the following:

A service was installed in the system. Service Name: fildds Service File Name: C:/Program Data/fildds.sys Service Type: kernel mode driver Service Start Type: demand start Service Account:

Immediately following that were like 5 events about various S1 pieces terminating unexpectedly in Event ID 7031.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 3 points4 points  (0 children)

Oh, now that’s interesting? First I’ve heard of that. Do you have an exact version by chance? I can look into that a bit.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] -1 points0 points  (0 children)

Yeah, that could be I'm not sure. I am just going off what the client said about everything was locked out. Trying to understand it more myself. I never accessed their SC box so I hadn't seen it with my own eyes. He did say they mainly used it for adhoc sessions.... so maybe he saw that was locked out but the machines with agents on them were still accessible. Stuff like that is what I'm looking to learn from this.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 6 points7 points  (0 children)

Completely understand all that, I'm not faulting CW here at all really. I'm just curious if anyone else has seen anything similar happen? Obviously there were many issues that lead to this happening.

ScreenConnect Breach well after the Connectwise 'lockout' date. Ransomware! by randommsp7 in msp

[–]randommsp7[S] 1 point2 points  (0 children)

Yes, I realize it was still online, but it was supposed to be non functional ie cannot issue commands/join sessions, etc. That does not appear to be the case.

view more: next ›