SmarterTools

Summary

SmarterTools suffered a ransomware intrusion after attackers exploited an unpatched instance of its SmarterMail email server to gain remote code execution, then moved laterally across Windows systems in its office network and a data center that hosted quality control testing, its portal and the Hosted SmarterTrack service, compromising twelve servers while leaving the public website, shopping cart and My Account portal untouched because they reside on a separate network. The ransomware group responsible, identified as Warlock, prompted the company to shut down affected servers, disable internet connectivity, remove Active Directory services and reset network passwords as it worked to eradicate the threat and restore safe operations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 29, SmarterTools experienced a ransomware attack that began through an unpatched instance of its SmarterMail email server running on a virtual machine. The compromised mail server served as the point of entrance for the threat actors. Upon detecting the breach, the company immediately shut off all servers at the two affected locations and disabled all internet connectivity. This action was taken to allow a full evaluation of the incident and to determine which systems needed to be eliminated or restored to a safe state.

After gaining access via the mail server, the attackers moved laterally across the data center and compromised twelve Windows servers that were present there. The affected environment included the office network and a data center that hosted quality control testing systems, the SmarterTools portal, and the Hosted SmarterTrack network. Services such as the company website, shopping cart, and My Account portal remained operational because they were hosted on a separate network. Because the ransomware exclusively targeted Windows systems, SmarterTools removed as many Windows servers as possible and eliminated Active Directory services from its environment. Passwords across the network were reset as part of the containment effort.

The ransomware operation was attributed to the group known as Warlock, which first appeared in June 2025 and is believed to operate from China. The attackers likely exploited CVE-2026-24423, an unauthenticated remote code execution vulnerability with a CVSS score of 9.3 that had been patched on January 15 together with CVE-2026-23760 and CVE-2025-52691. The US Cybersecurity and Infrastructure Security Agency had previously warned that CVE-2026-24423 was being used in ransomware attacks. SmarterTools also stated that the Warlock gang had compromised some of its customers. In response, the company noted that the security flaws were addressed in SmarterMail build 9518 released on January 15 and that a subsequent update, build 9526, was issued on January 22 to provide additional improvements.

Sources

Sources available to members: 1 source.