Remote access company AnyDesk has disclosed a breach of its systems and reset users’ passwords, with some user credentials allegedly leaked on dark web sites.
In a notice, the company also said it is revoking the code signing certificate used to sign its binaries, and will be issuing a new one.
This indicates that some source code may have been exfiltrated in the attack.
The password reset affects users of the company’s web portal, my.anydesk.com, and the company says users should reset passwords on any services they used the same credentials on.
AnyDesk said it took the action “following indications of an incident on some of our systems,” and that “a security audit … found evidence of compromised production systems.”
The organisation has notified authorities in the US and has called in CrowdStrike to help.
Resecurity said that on February 3, it “identified multiple threat actors selling access to compromised AnyDesk credentials on cybercriminal forums”, including one listing claiming to have 18,000 credentials for sale.
Resecurity noted that accounts listed for sale did not have MFA enabled.
