Cybersecurity agency ReliaQuest has confirmed being focused by hackers affiliated with the infamous ShinyHunters group, however claims the influence of the assault was restricted.
ReliaQuest revealed on August 17 in a publish on X that it had been monitoring a widespread ShinyHunters phishing marketing campaign involving domains with the ‘firm.claims’ URL sample.
The corporate additionally warned that the hacker gang has been increasing its social engineering techniques to incorporate authorized crew impersonation alongside IT and assist desk impersonation.
In response to that now-deleted publish, somebody shared a number of screenshots that appeared to point out entry to a ReliaQuest Okta dashboard.
The identical screenshots have been posted on ShinyHunters’ web site, together with a message taunting the safety agency.
ReliaQuest addressed the incident on Monday, admitting it had been focused in a social engineering assault over the weekend.
Based on the corporate, the hackers registered a pretend area and set it as much as host a ReliaQuest SSO phishing web page.
“The risk actor then referred to as a number of ReliaQuest teammates, every time posing as a safety worker by identify in an try to steer them in the direction of the pretend web page,” the safety agency defined. “One teammate entered their password and authorised the push notification on their telephone. That handed the attacker a short session on our id dashboard.”
ReliaQuest says the attackers obtained view-only entry to the dashboard, and identified that its purposes, programs, and buyer information weren’t compromised.
“The risk actor continued with makes an attempt to entry these purposes from the dashboard however was persistently denied because of the safety controls in place,” it famous.
ReliaQuest added, “No extra identities have been accessed, no enterprise purposes have been reached, no buyer or ReliaQuest information was accessed past the person’s login credentials, and no persistence was established. Claims that ReliaQuest was compromised or focused by ransomware are false.”
Associated: Cl0p Ransomware Group Names Over 40 Victims of PTC Windchill Marketing campaign
Associated: Private Data Uncovered in Apollo World Knowledge Breach
Associated: 1.6 Million Probably Impacted by RingCentral Knowledge Breach
