Malwarebytes said it was hit by the same hacking group that allegedly targeted software SolarWinds. However, it clarified that the attack was not related to the security incident at SolarWinds, as the company does not use any SolarWinds software on its internal network.
The security firm said the attackers breached its internal systems by exploiting a dormant email protection product in the Office 365 tenant. Additionally, Malwarebytes noted that it was notified of the cyberattack on December 15 by the Microsoft Security Response Center (MSRC) , which detected suspicious activity associated with the dormant Office 365 security app.
At the time, Microsoft was examining its Office 365 and Azure infrastructures for signs of malicious applications created by SolarWinds hackers, known as UNC2452 or Dark Halo .
As ZDNet reports, Malwarebytes noted that upon learning of the breach, it began conducting an internal investigation to determine what the hackers were able to access. Specifically, Marcin Kleczynski, co-founder and current CEO of Malwarebytes, said the following: “After an extensive investigation, we determined that the attackers only gained access to a limited set of internal company emails.”
Since the same hackers breached SolarWinds and then tried to infect the company's software by inserting the Sunburst malware into certain updates for the SolarWinds Orion application, Kleczynski pointed out that he also conducted a very thorough audit of all products and source code, looking for any signs of a breach or previous attack in the supply chain.
Kleczynski stressed that they have not found any evidence of unauthorized access or compromise in any of Malwarebytes' internal systems or production environments, and that the company's software remains safe to use.
It is worth noting that Malwarebytes is the fourth major security vendor targeted by the UNC2452/Dark Halo hackers, who US officials have linked to a Russian government espionage . Companies that have been targeted by the same hacking group include FireEye, Microsoft, and CrowdStrike.
