Cyber Attack on Security Firm Dr.Web Forces Servers Disconnection

In a recent cyberattack, Russian cybersecurity firm Doctor Web (Dr.Web) was forced to disconnect all its servers to mitigate the threat and ensure the safety of its infrastructure.

The attack, which began on Saturday, September 14, 2024, was swiftly identified and managed by the company’s security team. Dr.Web, known for its antivirus software, took immediate action to prevent any potential damage to its systems and protect its users.

The breach was detected on September 16, when signs of unauthorized interference with the company’s IT infrastructure emerged.

In response, Dr.Web adhered to its security protocols by disconnecting its servers from the network. This precautionary measure temporarily halted updates to their virus database, a critical component of their antivirus services.

Dr.Web employed a comprehensive diagnostic process to address the incident using their specialized tool, Dr.Web FixIt! for Linux. This tool is designed for in-depth analysis and remediation of security incidents.

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

The company confirmed that the threat was successfully isolated and that none of its clients were affected by the attack.

By September 17, Dr.Web had resumed virus database updates after ensuring that their systems were secure and operational.

The company emphasized that despite the disruption, their proactive measures ensured that no client data or systems were compromised during the incident.

Dr.Web’s swift response highlights the importance of having robust incident response plans in place. Such plans are crucial for minimizing damage and ensuring business continuity in the face of cyber threats.

The company continues to uphold high-security standards and is committed to restoring full functionality across all systems.

This incident is part of a broader trend of cyberattacks targeting Russian cybersecurity firms. Earlier attacks have been attributed to groups like Cyber Anarchy Squad, which have targeted other firms such as Avanpost and Infotel. These attacks underscore the ongoing cyberwarfare dynamics in Eastern Europe.

As Dr.Web works to restore its services fully, it remains vigilant against future threats, reinforcing its systems to prevent similar incidents.

The company has not disclosed specific details about the perpetrators or methods used in this attack but assures customers that all necessary steps have been taken to secure their infrastructure.

Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN - 14-day free trial