A new strain of backdoor malware has been discovered and named as Sidewalk. And the hacking group behind it – Grayfly – mean business.
Believed to have major links to China, Grayfly has been launching global cyber-attacks since 2017 and has also operated under the names of Wicked Panda and GREF. With a keen interest in espionage, Grayfly favors attacking public facing web servers. Once they have their foot in the door, the hackers being installing backdoors across the network to maximize their access. The Grayfly group represent a sophisticated threat and show few signs of letting up in their endeavors.
The Sidewalk malware, which appears to be Grayfly’s latest weapon, has been attacking servers in the US, Mexico and Asia. Accordingly, you need to be on your guard.
How Does the Sidewalk Malware Work?
Sidewalk was first discovered in August 2021 when a new piece of malware was detected by Slovakian researchers. Sidewalk, it was revealed, operates by loading plugins into breached systems to search out and log running processes. This information is then transmitted back to a remote server where hackers can analyze the infected servers in forensic detail. The researchers were keen to note that the Sidewalk malware shared many similarities to Grayfly’s previous hacking tool Crosswalk.
Sidewalk has been concentrating its efforts on a number of targets in the US, Vietnam, Mexico and Taiwan. Given the espionage nature of Grayfly’s operation, it comes as no surprise that a large proportion of the victims are involved in the telecoms industry. Grayfly start these attacks by identifying Microsoft Exchange servers which can be accessed through the public internet. With this in their sights, the hackers install a web shell which grants them the opportunity to run administrative commands on the server. From here they can dig deeper into the server and begin harvesting confidential data such as login credentials.
How Can You Protect Your Public Facing Server?
Public facing servers are crucial for any businesses which need to allow the public to access their services are online. However, as the Sidewalk malware has shown, they’re at the risk of cyber-attacks. Nonetheless, you can protect your public facing servers by practicing the following:
- Monitor Logins: By using specialist security tools, you can monitor login attempts to your server. These will monitor suspicious activity such as brute force attacks and can block IP addresses suspected of being dangerous.
- Only Allow Strong Passwords: Servers need to use strong passwords to thwart the efforts of hackers. Avoid making common password mistakes and always change any default passwords as soon as possible.
- Use Secure Sockets Layer Certificates: Your web administration areas should always be protected by a Secure Socket Layer (SSL). These security certificates protect and encrypt information passed between two systems on the internet e.g. a website and a visitor to that website. This ensures that personal data remains secure.
- Always Upgrade Your Software: One of the surest ways for a public facing server to become breached is by eliminating vulnerabilities in its design. These weak points allow hackers to gain easy access, so it’s vital these are plugged. Software and hardware manufacturers regularly release firmware and security patches, so make sure these are installed as soon as possible.
For more ways to secure and optimize your business technology, contact your local IT professionals.
