SonicWall has issued an alert on a campaign distributing a modified version of its NetExtender application to steal user information.
An SSL VPN application, NetExtender provides remote users with secure access to enterprise resources, offering file download and upload capabilities, network drive access, and more.
“In collaboration with Microsoft Threat Intelligence (MSTIC), SonicWall has identified a deceptive campaign to distribute a hacked and modified version of SonicWall’s SSL VPN NetExtender application that closely resembles the official SonicWall NetExtender software,” the company announced.
The trojanized version of the application was built using the latest NetExtender release (version 10.3.2.27) and is digitally signed with a certificate issued for Citylight Media Private Limited, SonicWall explains.
The malicious code in the modified application was designed to fetch information related to the user’s VPN configuration and send it to a remote server.
According to SonicWall, the threat actor modified two components of the NetExtender installer, namely the NeService and NetExtender executables.
In the former, the attacker modified a function that validates the digital certificates of NetExtender components, so that files would be executed regardless of the validation results.
The latter contains code that activates when the user clicks the ‘Connect’ button, to perform validation of the VPN configuration and send the information to the attacker’s server.
“Stolen configuration information includes the username, password, domain, and more,” SonicWall says.
Together with Microsoft, the company took down the impersonating websites and revoked the installer’s digital certificate. Both have added signatures to their security solutions to detect the fake NetExtender iteration.
“It is strongly recommended that users download SonicWall applications only from trusted sources: sonicwall.com or mysonicwall.com,” SonicWall notes.
Related: Possible Zero-Day Patched in SonicWall SMA Appliances
Related: PoC Published for Exploited SonicWall Vulnerabilities
Related: SonicWall Flags Two More Vulnerabilities as Exploited
Related: SonicWall Patches High-Severity Vulnerability in NetExtender
