Wipro Compromise

Unidentified threat actor(s) have compromised Wipro and reportedly leveraged this access to target Wipro client networks [1]. Wipro is an IT services company with a large number of customers across twenty-five unique industries [2]. The date of initial compromise is unknown at this time, but early reporting suggests the intrusion has likely been ongoing for several months. Due to the compromise, clients of Wipro have been exposed to an increased risk of targeted attacks.

Details of this incident are still emerging, but Wipro customers are encouraged to follow the best practices for managing supply chain threats. eSentire Threat Intelligence will continue to monitor this topic for additional information as it emerges.

What are we doing about it

• The eSentire Threat Intelligence Team is monitoring this issue for additional information

What you should do about it

• For broader recommendations pertaining to managing supply chain risks, see the US-CERT Alert

Additional information

In a public announcement, Wipro confirmed the attack and stated that remediation and mitigation measures have been implemented to limit potential impact. The breach became public knowledge after an article by Brian Krebs was published on April 15th. Krebs reported that Wipro is in the process of sharing indicators of compromise (IOCs) with concerned clients. This attack is especially concerning as it exploits the trust relationship between Wipro and its clients.

References:

[1] https://krebsonsecurity.com/2019/04/experts-breach-at-it-outsourcing-giant-wipro/

[2] https://www.wipro.com/

[3] https://www.us-cert.gov/ncas/alerts/TA18-276B