TeamViewer targeted by hackers, possibly Russian hacking group APT29

The security team of remote access control tool TeamViewer found out that the company was targeted by hackers. However, there’s no indication the attackers laid their hands on any confidential information.

In a statement TeamViewer says an ‘irregularity’ was detected on the company’s internal network on Wednesday June 26. IT employees immediately responded by implementing remediation measures.

At the same time, the company called in the help of third-party cybersecurity experts and started an investigation into what exactly happened.

TeamViewer points out that the corporate IT environment and the product environment are separated from one another. Access to one part of the network doesn’t mean that the attackers were able to view or copy consumer data.

“Investigations are ongoing and our primary focus remains to ensure the integrity of our systems,” TeamViewer notes in a press release. The company promises to keep all those who are interested in the security incident posted on all the latest developments.

At this point, TeamViewer will not provide any more information regarding the incident.

Security expert: ‘APT29 responsible for cyber attack’

IT Security professional Jeffrey was the first to report on the breach. On Mastodon he says that an Advanced Persistent Threat of APT is actively exploiting TeamViewer, possibly APT29.

APT29, also known as Cozy Bear, Nobelium and Midnight Blizzard, is a hacking group that operates from Russia and is linked to the Russian foreign intelligence service SVR. It’s an infamous group which is said to be responsible for many cyberespionage activities on politicians in Western countries.

The Health Information Sharing and Analysis Center (Health-ISAC) recommends organizations that use TeamViewer to review their logs for any unusual remote desktop traffic.