Mitsubishi Power: attackers entered through a managed service provider and took IT data such as server settings and account details

1. 2020-09-07

   Attackers put malware on one of the company's servers through a managed service provider (MSP) and probed the internal network until the 11th. [1] [2]

2. 2020-09-11

   They began spreading the infection. Traces stopped on the 12th, and activity paused until the 20th. [1]

3. 2020-09-21

   The attack resumed. On the 22nd the attackers moved their base from the company's server to a group company's server. [1] [2]

4. 2020-10-02

   The company noticed suspicious behavior on a PC. By the 3rd it had cut affected devices off the network and blocked the external addresses used for illegal traffic. [1]

5. 2020-10-07

   It traced the entry point to the MSP, cut related devices and traffic, and finished containment. On the 8th it asked the MSP to investigate, and on the 12th it was told that a break-in had occurred. [1]

6. 2020-12-11

   The company disclosed the case. [1]

The impact was limited to the company and its group companies. The confirmed leaks were IT-related data such as server settings, account details and memory dumps from authentication processes. No sensitive or highly confidential technical information, key partner information or personal data was confirmed leaked, and no access to the networks of the parent Mitsubishi Heavy Industries group was found. [1] [2]

The first entry came through a vulnerability in software supplied by the MSP. It was a so-called zero-day flaw, unpublished and without a fix, and the company stopped using the software with Mitsubishi Heavy Industries. The infection spread quickly because there was no firewall between the UNIX servers run by the MSP and the internal network, so traffic was not limited. [1] [2]

The company cut the link to the MSP and stopped using its service, and is checking that firewalls exist at connection points with partner firms. It did not name the MSP and did not say whether the case is related to Hitachi Systems, which had disclosed an intrusion earlier. [1] [2]