Accesses occurred from multiple endpoints (based on the endpoint names listed in the logs), including those with “-HOME” included in the name.įor endpoint B, the connections_incoming.txt log entries extended back to 2018, but also showed that before the threat actor’s access, the last login session to the endpoint via TeamViewer had occurred over three months prior. As we can see, the login session for endpoint A lasted approximately 7½ minutes, whereas the session for endpoint B lasted just over 10 minutes.įor endpoint A, the TeamViewer connections_incoming.txt log entries illustrated repeated access by several specific individuals, whom Huntress determined to be legitimate administrators. Log entry from endpoint A: WIN-8GPEJ3VGB8UĒ1-12-2023 16:22:15Ē1-12-2023 16:29:51 user RemoteControl īoth log entries were extremely valuable, as they not only demonstrate that a source endpoint with the same name connected to both endpoints, but they also provide the time and length of the login session. The final entry from the TeamViewer connections_incoming.txt log file showed the threat actor’s access to each endpoint. Initial AccessĪn investigation into each endpoint illustrated that initial access to each endpoint was achieved via TeamViewer.

Based on observed file names, the observed incidents appear to be similar to what was discussed via the VMWare blog from October 15, 2022, titled, “ LockBit 3.0 Ransomware Unlocked”. In one of the incidents, the threat actor’s actions were inhibited by installed security software. In neither instance was there any indication of the threat actor conducting reconnaissance activities beyond the impacted endpoint, nor attempting to move laterally to other endpoints within the infrastructure. Huntress SOC analysts recently alerted customers regarding two disparate endpoints identified as being minimally impacted by ransomware that is, only a limited number of ransomware canary files were encrypted.

Teamviewer apk file free download