In The News: WiPro Compromised

On April 16 2019, the India Times published that the IT outsourcing and consulting giant WiPro confirmed their IT systems were compromised. Prior to the India Times article, Brian Krebs independently reported that Wipro was dealing with a multi-month intrusion from an assumed state-sponsored actor. The compromised systems were being used as a pivoting point to attack WiPro customer systems. Sources close to Krebs said that at least 11 WiPro customers were affected, as they found artifacts of these customers on the back-end infrastructure of the attacker. The initial breach is believed to be through a phishing email.

Recommendations

If you are a WiPro customer, consider contacting your account manager there for an update on this compromise
Use the Indicators of Compromise in the Details section to perform analysis of the intrusion on your systems
Train your employees the best practices on phishing prevention

Details

The discovery of the attack was through 2 trusted sources close to Krebs. The article also outlines an attempt of Krebs trying to contact WiPro for comment on April 9 and did not get a response until April 12. The attackers supposedly abused their access to perform gift card fraud on one of WiPro’s retail customers. The forensic investigation, and subsequent IOCs, yielded that attackers obtained access via phishing emails and maintained access with a popular remote access tool, ScreenConnect.

Indicators of Compromise

Malicious Domains:
xsecuremail[.]com
wipro365[.]com
microsoftonline-secure-login[.]com
secure-message[.]online
encrypt-email[.]online
secured-mail[.]online
internal-message[.]app
encrypted-message[.]cloud

Malicious IP Addresses:
65[.]52[.]17[.]132
52[.]191[.]194[.]66
163[.]172[.]204[.]41
137[.]135[.]91[.]49
78[.]142[.]62[.]200

MD5                                  SHA1                                           File Name
95f04aa18dc27e4f0c73ac6829dcc3d8     0x2f361486c18e23cea4b375e1c9cccdc14bdd620d     ScreenConnect.WindowsClient.exe.config
29cd6dfecba72957d72ba539a9d3a489     0x4791ffdc93a896293544acc868ec0b99b93ee667     ScreenConnect.ClientService.exe
e6c3816372b044b3cb89188c421b23b8     0x4ed583aa32043deefda57d02c18b4e6f03b426cf     ScreenConnect.Client.dll
fcba211bca9d3514718fc371c817558a     0xcc5e05970d7798e40c5eba95b670f6dc6a78c26d     ScreenConnect.Core.dll
35afdddc519859bb0d0040a5b12d97f9     0x92ef9788568f4b5d6f5014e41d9d9663c7c659b1     ScreenConnect.WindowsClient.exe
11713afad22a3198479898b4b6916de3     0x3b8ae3b0d58c804a525dec63cdb4b12ffb75483a     ScreenConnect.ClientService.dll
99fe092ddca873c2f7c36439913f8b0b     0x57c1bed746895e6ba48a436700c9df75f53bc702     ScreenConnect.Windows.dll
4d5b8d2cd7ebada296f675484cb43bfc     0xa5988a23d0f1d09e807600eabaa170336e3c1af1     Client.resources
0b0b9684f87f73d26f31d558a4edddb2     0xed7396e7917754f020c71dc2f94b34cf64595f2d     Event Viewer.evtx
02617920479e65136f9164fb8e42fe30     0xd3e62e844f6974933840c540b5a1ee9eb6a1164f     app.config
1c48f5e0d1f72fa86bce4fcb6649a219     0xe2c3e787aacb17beb3b82d2f0017dbc8086e2ef0     Client.en-US.resources
e2e88d6ea5d5d2a4c7b8039988644043     0x1a1db93766e31994507511c9c70a1dd94465cf6d     abc.ps1
dd5986339aaf23f2baf8c245923a0f69     0xac9fc01c1284bbe9ee4ddf424216a82b5d64a42c     sc.ps1