Cloudflare Joins Twilio in Releasing Information On a Connected Phishing Attack
Table of Contents
- Published: Aug 12, 2022
- Last Updated: Aug 22, 2022
Following a statement by Twilio outlining a phishing attack that led to a data breach, Cloudflare released a statement sharing they were a victim of the same attack. Employee credentials were stolen during a phishing attack that was nearly identical to the attack that hit Twilio.
Thankfully, the credentials were not enough for hackers to permeate the accounts. Cloudflare issues FIDO2-Compliant keys that employees must use to authenticate themselves when using their login credentials. The hackers did not have access to these keys, ultimately denying them entry into the company's internal systems.
Cloudflare shared that “around the same time as, we saw an attack with very similar characteristics” and the focus was also the employee credentials, just like the Twilio attack.
Cloudflare requires that every employee use a physical key to connect to applications and devices after inputting their login information. Hackers could not bypass the requirement for those keys, ultimately saving data from falling into the wrong hands.
Following the employees entering their personal credentials to the pages, hackers pushed an automatic download of AnyDesk remote software. Had this been installed, hackers could have remotely controlled each computer.
The Cloudflare phishing attack targeted 76 employees, along with their families. The messages sent responders to landing pages that matched the host from the Twilio attack. In response to the attack, Cloudflare has taken several steps, including:
- Blocking the domain through Cloudflare’s gateway
- Identifying each employee credential that was affected and resetting their information
- Removing the infrastructure used by the hackers
- Updating the detection software to look for subsequent attacks
- Thoroughly auditing their logs to look for additional attacks
Cloudflare is working with investigators to keep their data and that of each employee and customer safe. The goal is for all affected companies to partner together to stop these hackers from being able to do any additional damage.
