Sonicwall says malicious Netextender client VPN is used to steal credentials

Sonicwall has issued an advice that informs customers that a malicious version of its sonicwall SSL VPN Netextender app is being used to steal VPN configurations and credentials. The company has warned that the danger actors have modified two files used by the Netxer VPN application, which are used by several organizations to allow remote users to safely connect to the main network. Microsoft and Sonicwall have taken measures to block the spread of revised versions of the Netextender application.

Sonicwall Netextender VPN application was digitally signed by danger actors

In a security advisor released earlier this week, Sonicwall said that he discovered it Revised version of Netextender SSL VPN application Microsoft Danger in collaboration with intelligence (MStic). The malicious version of the app was hosted on a website, which allowed users to download the treated version of the latest release, version 10.3.2.27.

Netextender Application File
Photo Credit: Sonicwall

According to the company, the danger actors signed the tragged version of the Netxandar app digitally, which allowed it to bypass the security check on Windows. It was signed using a digital certificate issued to “Citylight Media Private Limited”.

If a user downloads the fake version of the Sonicwall Netextender VPN app, it will install two modified applications, “neservice.exe” and “Netextender.exe”. The change of actor with danger in neservice.exe allowed him to bypass the digital certificate check done on loading the app.

Meanwhile, the modified Netextnder.exe application will collect details about the user’s VPN configuration, including their user names, passwords, domains, and other information. After clicking by the user, they will be sent to the remote server Add button.

Sonicwall has updated its malware detection tool and will automatically block malicious software after identifying it as GAV: fake -netexTextender (trojan). Microsoft’s Windows Defender will also detect the tragged version of the software app, which is classified as “Silentroute” Trojan (“Trojanspy: Win32/Silentroute.a”).

The digital certificate used to sign the installer has also been canceled, and the companies worked to take down the websites that were being used to implement the NETEEXEDED VPN application. Meanwhile, Sonicwall has urged users to download the application from their website instead of using third -party sources.