A software update to Click Studios Passwordstate password manager contained malware.
In an attack very reminiscent of the SolarWinds attack , a malicious update to Click Studios' Passwordstate password management platform dropped malware on the company's systems.
So Click Studios warns its customers to immediately change all saved passwords for their accounts to VPNs, firewalls, switches, local accounts and servers.
The attack was revealed today by investigators from the CSIS Security Group, which also published the indicators of the attack - which they have named Moserpass.
According to CSIS, the breach occurred between April 20 and April 22, using a malicious update via a zip file named Passwordstate_upgrade.zip containing a malicious DLL (moserware.secretsplitter.dll).
Click Studios reported that the command-and-control of the attack ended on April 22.
Click Studios has approximately 29.000 corporate and government clients worldwide, in aerospace, banking, defense, healthcare, utilities and more.
Read the CSIS team's findings here.
George is still wondering what he is doing here….
