Incident
incident:asnarok
Initial widespread attack against internet-facing Sophos Firewalls, affecting a reported tens of thousands of devices.
Initial widespread attack against internet-facing Sophos Firewalls, affecting a reported tens of thousands of devices.
“80,000 Sophos Firewalls hacked into”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INITIAL_ACCESS_VIA | SQL injection | Derived | 174 |
| outgoing | INVOLVES | Asnarok | Explicit | 174 |
| outgoing | INVOLVES | Sophos XG Firewall | Explicit | 174 |
| outgoing | INVOLVES | sophosfirewallupdate.com | Explicit | 174 |
| outgoing | INVOLVES | sophosproductupdate.com | Explicit | 174 |
| outgoing | INVOLVES | National Cyber Security Centre Netherlands | Explicit | 174 |
| outgoing | INVOLVES | Dutch National High Tech Crime Unit | Explicit | 174 |
| incoming | INVOLVES | Pacific Rim Campaign | Explicit | 174 |
Asnarok INITIAL_ACCESS_VIA SQL injection
The Asnarok incident initially gained access through the SQL injection vulnerability in the firewall's web UI.
Derived Confidence 96% · Jack Rhysider EP 174 Details
“an attacker could enter in some commands there which would glitch out the user input handling mechanism of the firewall and allow the attacker to inject their own commands into the database”
The incident was named Asnarok by the Sophos team.
Explicit Confidence 99% · Craig Jones EP 174 Details
“We called it Asnarok”
Asnarok INVOLVES Sophos XG Firewall
The Asnarok attack affected publicly exposed Sophos XG Firewalls; the episode says a very large number of devices were compromised.
Explicit Confidence 98% · Andrew Brandt EP 174 Details
“essentially every firewall that was facing the public internet was affected by this bug”
Asnarok INVOLVES sophosfirewallupdate.com
The attack redirected firewalls to sophosfirewallupdate.com for update retrieval.
Explicit Confidence 99% · Craig Jones EP 174 Details
“it was a wget to a domain called sophosfirewallupdate.com”
Asnarok INVOLVES sophosproductupdate.com
The wider attack infrastructure also used sophosproductupdate.com as an update domain.
Explicit Confidence 99% · Andrew Brandt EP 174 Details
“there was sophosfirewallupdate.com and sophosproductupdate.com”
Asnarok INVOLVES National Cyber Security Centre Netherlands
The Netherlands NCSC helped coordinate the response to the threat actor's server.
Explicit Confidence 98% · Craig Jones EP 174 Details
“through the NCSC in the Netherlands — they were kinda an intermediary”
Asnarok INVOLVES Dutch National High Tech Crime Unit
The Dutch National High-Tech Crime Unit obtained and enabled analysis of the threat actor's C2 server.
Explicit Confidence 99% · Craig Jones EP 174 Details
“the Dutch National High-Tech Crime Unit just jumped on this, and they managed to get hold of this C2 server”
Pacific Rim Campaign INVOLVES Asnarok
Asnarok was one of the incidents in the broader Pacific Rim Campaign.
Explicit Confidence 99% · Jack Rhysider EP 174 Details
“they called this whole series of incidents the Pacific Rim Campaign”