DGSSI warns after cyberattacks on six service providers
By the AFREEQUE newsroom, based on Le Matin
Morocco’s DGSSI warns of cyberattacks that compromised the administrative consoles of at least six IT service providers. In 90 minutes, the attackers sent commands to at least 288 computers in 48 organisations, according to the Directorate-General for Information Systems Security.
Hackers took control of the administrative consoles of at least six IT service providers before using these accesses to send commands, within 90 minutes, to at least 288 computers across 48 organisations, according to the Directorate-General for Information Systems Security (DGSSI), which comes under the National Defence Administration.
The attackers hijacked the “Run Command” function of ConnectWise ScreenConnect, software that allows technicians to remotely administer their clients’ equipment, to install a second connection tool under their control. They also deployed “SCKit”, a malicious programme designed to maintain their presence in the compromised systems and complicate interventions by security teams, according to the DGSSI.
The DGSSI describes the risk level and impact of this campaign as “critical”. The use of IT maintenance providers allows attackers to turn the compromise of a single administrative access point into an entry point to the systems of several organisations, according to the alert published on Thursday.
