Attackers Used Plaintext Recovery Codes to Access Huntress Portal and Disable Defenses
Summary
After compromising a victim’s SonicWall VPN, attackers found plaintext Huntress recovery codes, bypassed MFA to access the portal, closed incident reports, and attempted to remove endpoint agents. Huntress isolated systems to limit the ransomware impact.
Key points
- Attackers reportedly gained initial access through the victim’s SonicWall VPN and used internal network access to search for sensitive files.
- They found Huntress recovery codes in a plaintext file on a security engineer’s desktop and used them to bypass MFA and access the Huntress portal.
- The attackers closed active incident reports and attempted to de-isolate systems and uninstall Huntress agents.
- Huntress’s SOC detected suspicious activity, initiated mass isolation, and limited the spread of Akira ransomware; a workstation was encrypted.
- Investigators also observed certificate enumeration and export, which could enable user or device impersonation, but could not determine the root cause of that activity.
- Huntress recommends storing recovery codes in an encrypted password manager, treating them like privileged credentials, and rotating them where possible.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- Ransomware intrusion involving compromise of a SonicWall VPN, theft and use of Huntress recovery codes to access the Huntress portal, and attempts to suppress alerts and remove endpoint protections.
- Operational Impact
- A workstation was encrypted by the Akira ransomware binary. Huntress mass isolation hindered encryption of the wider environment. The threat actor accessed the Huntress portal, closed incident reports, and initiated Huntress agent uninstallations; the article describes removal of protections as an attempt.
- Ransom Or Extortion
- No ransom demand or extortion activity is reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]238[.]221[.]69 | Malicious IP that the article says accessed the Huntress portal using compromised recovery codes. |
| SHA256 | 6f1192ea8d20d8e94f2b140440bdfc74d95987be7b3ae2098c692fdea42c4a69 | SHA-256 hash identified in the article for the ransomware executable w.exe. |
Threat Actors
Malware
Vendors
HuntressThat's exactly what happened to a Huntress partner. Later in this article, we walk through how a single plain text file on a security engineer's desktop gave a threat actor full access to their Huntress portal, and whatSonicWallThis is an offshoot of our other blog, "Huntress Threat Advisory: Active Exploitation of SonicWall VPNs," which allowed initial access and was followed by the rapid deployment of Akira ransomware across the victim
Products
HuntressThat's exactly what happened to a Huntress partner. Later in this article, we walk through how a single plain text file on a security engineer's desktop gave a threat actor full access to their Huntress portal, and whatSonicWallThis is an offshoot of our other blog, "Huntress Threat Advisory: Active Exploitation of SonicWall VPNs," which allowed initial access and was followed by the rapid deployment of Akira ransomware across the victim