SonicWall Says Malicious NetExtender Client Used to Steal VPN Credentials

SonicWall has issued an advisory that informs clients {that a} malicious model of its SonicWall SSL VPN NetExtender app is getting used to steal VPN configuration and credentials. The corporate warns that menace actors have modified two recordsdata utilized by the NetExtender VPN software, which is utilized by a number of organisations to permit distant customers to securely connect with the principle community. Microsoft and SonicWall have taken measures to dam the unfold of the modified variations of the NetExtender software.

SonicWall NetExtender VPN Software Was Digitally Signed By Menace Actors

In a safety advisory issued earlier this week, SonicWall mentioned that it detected the modified version of the NetExtender SSL VPN application in collaboration with Microsoft Menace Intelligence (MSTIC). The malicious model of the app was hosted on a web site that allowed customers to obtain the trojanised model of the newest launch, model 10.3.2.27.

The NetExtender software recordsdata modified by the menace actor
Photograph Credit score: SonicWall

In accordance with the corporate, the menace actors digitally signed the trojanised model of the NetExtender app, which allowed it to bypass safety checks on Home windows. It was signed utilizing a digital certificates issued to “CITYLIGHT MEDIA Non-public LIMITED”.

If a consumer downloaded the pretend model of the SonicWall NetExtender VPN app, it could set up two modified functions, “NeService.exe” and “NetExtender.exe”. The menace actor’s modifications to the NeService.exe allowed them to bypass the digital certificates checks carried out when the app is loaded.

In the meantime, the modified NetExtender.exe software would gather particulars in regards to the consumer’s VPN configuration, together with their username, password, area, and different info. These could be despatched to a distant server as soon as the consumer clicked the Join button.

SonicWall has up to date its malware detection software and can robotically block the malicious software program after figuring out it as GAV: Faux-NetExtender (Trojan). Microsoft’s Home windows Defender software program may also detect the trojanised model of the app, which is categorised as “SilentRoute” Trojan (“TrojanSpy:Win32/SilentRoute.A”)

The digital certificates used to signal the installer has additionally been revoked, and the businesses labored to take down the web sites that have been getting used to impersonate the NetExtended VPN software. In the meantime, SonicWall has urged customers to obtain the appliance from its web site as an alternative of utilizing third occasion sources.