Landesk

Summary

An IT automation firm experienced a breach involving unauthorized access to its network over an extended period, discovered after employees reported performance issues. Attackers compromised credentials of domain administrators, potentially exposing employee personal information and exfiltrating source code and build server data. The intrusion enabled threat actors to systematically archive and transfer proprietary software assets, raising concerns about potential backdoors in widely deployed management products. While the company stated no confirmed compromise of customer environments or identified exploits targeting its software, the theft of intellectual property could facilitate vulnerability discovery in its solutions. The incident prompted internal investigations and forensic analysis, with limited employee notifications regarding possible data exposure.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 18, 2015, LANDESK, an IT automation software provider based in South Jordan, Utah, notified current and former employees of a data breach potentially exposing their personal information, including names and Social Security numbers. The company detected unusual activity on its systems and initiated safeguards and an investigation with a computer forensics firm. According to an anonymous employee, the breach was discovered after coworkers reported slow Internet speeds and a developer identified unauthorized access to his build server by someone impersonating IT personnel. System logs revealed the initial intrusion occurred 17 months earlier, in June 2014. Investigators determined attackers compromised the passwords of LANDESK’s global IT director in Utah and a domain administrator in China, enabling prolonged access to critical infrastructure.

Attackers methodically archived data from LANDESK’s build and source code servers over 17 months, uploading it to the company’s own web servers for exfiltration. The theft of source code raised concerns about potential backdoors in LANDESK’s software—used by thousands of customers worldwide for systems management, endpoint security, and device administration—and the possibility of attackers exploiting undiscovered vulnerabilities. LANDESK confirmed no customer data compromises but acknowledged a "small amount" of employee personally identifiable information might have been accessed. The company notified potentially affected employees and emphasized ongoing investigation, declining to confirm breach timelines or source code theft specifics. In a public statement, LANDESK asserted no confirmed risks to customer environments or known attack vectors leveraging its software but advised customers to review security best practices.

Sources

Sources available to members: 1 source.