Full Report
Huntress is tracking concerns regarding the AnyDesk remote control software and provider.
Analysis Summary
# Incident Report: AnyDesk Compromise and Code Signing Certificate Revocation
## Executive Summary
AnyDesk, a widely used remote desktop software provider, suffered a security breach resulting in the potential compromise of their production systems and code signing certificates. The incident led to the revocation of their previous code signing certificate and the mandatory migration of users to version 8.0.8, which utilizes a new certificate. While AnyDesk reports no evidence of end-user device impact, the compromise poses a significant risk of "living-off-the-land" attacks where malicious binaries could be signed with legitimate AnyDesk credentials to bypass security controls.
## Incident Details
- **Discovery Date:** February 2, 2024 (Public reports and community rumors surfaced)
- **Incident Date:** Late January to early February 2024
- **Affected Organization:** AnyDesk Software GmbH
- **Sector:** Information Technology / Remote Monitoring and Management (RMM)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Specific date not disclosed; confirmed by AnyDesk on Feb 2, 2024.
- **Vector:** Compromise of internal production systems.
- **Details:** Attackers gained access to AnyDesk's internal environment, leading to the potential theft of sensitive source code and security certificates.
### Lateral Movement
- **Details:** Specific lateral movement techniques within AnyDesk's infrastructure were not disclosed in the threat advisory.
### Data Exfiltration/Impact
- **Details:** Potential theft of code signing certificates. This allows attackers to sign malicious software, making it appear as legitimate AnyDesk traffic/applications to antivirus and EDR solutions.
### Detection & Response
- **How it was discovered:** Initial detection through community observation of sudden certificate changes in version 8.0.8 and maintenance windows.
- **Response actions taken:** AnyDesk revoked compromised certificates, replaced them with a new certificate, forced a software update, and published a public statement confirming the situation was "under control."
## Attack Methodology
- **Initial Access:** Compromise of internal production servers (method undisclosed).
- **Persistence:** Not specified, though code signing theft provides long-term utility for masquerading.
- **Privilege Escalation:** Not disclosed.
- **Defense Evasion:** Use of legitimate code signing certificates to bypass Signature-based detection and Application Control policies.
- **Credential Access:** Potential theft of certificates and internal credentials.
- **Discovery:** Not disclosed.
- **Lateral Movement:** Not disclosed.
- **Collection:** Source code and digital certificates.
- **Exfiltration:** Exfiltration of internal production data and certificates.
- **Impact:** Software supply chain risk; potential for malicious binaries to be trusted by global security stacks.
## Impact Assessment
- **Financial:** High (Costs associated with incident response, legal, and certificate revocation).
- **Data Breach:** Source code and code signing certificates.
- **Operational:** Disruption to AnyDesk services during the incident remediation; requirement for all global users to update software.
- **Reputational:** High; loss of trust in a tool that inherently has high-level access to client systems.
## Indicators of Compromise
- **Network indicators:** None provided in the specific advisory (monitor for anomalous RMM traffic).
- **File indicators:** Binaries signed with the old AnyDesk certificate (revoked) after the incident date.
- **Behavioral indicators:** AnyDesk executable (anydesk.exe) or related processes performing unusual activities (e.g., PowerShell execution, credential dumping) not typical of tech support sessions.
## Response Actions
- **Containment measures:** Revocation of the compromised code signing certificate.
- **Eradication steps:** Remediation of production systems and rotation of all internal passwords and security tokens.
- **Recovery actions:** Release of Version 8.0.8 with a new certificate and public advisory for users to update.
## Lessons Learned
- **Key takeaways:** Even trusted RMM tools are high-value targets for supply chain attacks. A signed binary does not inherently mean a binary is safe.
- **What could have been done better:** Earlier transparency from the provider could have assisted defenders in proactive hunting before community rumors forced a statement.
## Recommendations
- **Immediate Action:** Update all AnyDesk installations to version 8.0.8 or higher.
- **Security Audit:** Review logs for AnyDesk usage, specifically checking for versions signed with the old certificate.
- **Tool Governance:** Implement strict controls on which RMM tools are allowed in the environment; block unauthorized RMM software at the network and endpoint level.
- **Detection:** Use Sigma or YARA rules (like those provided by Florian Roth) to identify binaries signed with the compromised AnyDesk certificate.