Threat Intelligence Brief
Curated summary with source attribution
Source: techradar.com
Threat Risk: Medium
Victim: Web hosting customers
Incident: A vulnerability in DreamHost’s File Manager allowed unauthorized access to user credentials and webmail sessions.
Impact: Leakage of login credentials increases the risk of phishing, spam, and Business Email Compromise.
Attacker: Unidentified threat actors
Analysis: Attackers exploited a software flaw in the web-based File Manager to harvest FTP/SFTP credentials and webmail session data. This exposure creates a significant risk of Business Email Compromise (BEC) and targeted phishing campaigns. While billing data remains secure, the compromise of hosting access could lead to site defacement or further lateral movement.
Recommendations: Immediately rotate all FTP/SFTP and webmail passwords for DreamHost accounts.; Enable multi-factor authentication (MFA) on all hosting control panels and associated emails.; Monitor email logs for unauthorized access or signs of phishing activity originating from compromised accounts.
Source: TechRadar
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source