1-minute read
What a defender needs to know
An MSP administrator searching for the WatchGuard SSL VPN client reached watchguard-vpn[.]net, a lookalike download site. Huntress traced the October 7 visit through a Bing search-result redirect. The page requested the VPN Server, Login and Password in a browser prompt and sent submitted values to watchguard-ssl[.]online. It rejected the first set, asked again, then started a genuine, signed WatchGuard client download after the second submission.
The signed installer is part of the deception: credential collection happened before it. Huntress saw no CDN download in the investigated browser history, so a first submission still needs investigation even when no installer arrived. The lure was offline as of October 13.
Search browser, proxy and DNS history for watchguard-vpn[.]net, watchguard-ssl[.]online, lure IP 80.249.132[.]140 and collector IP 158.94.209[.]19 in the relevant time window. For anyone who entered credentials, reset the password and check SSL VPN authentication logs for that account and server, especially unfamiliar hosting-provider, ASN or country origins. Record the entered VPN server address with the account so login review covers that endpoint. If the logs show unexpected access, preserve the session details and investigate activity performed with that administrator’s privileges. Review subsequent access, enforce MFA on the VPN and verify a fresh login prompts for it. Give administrators a bookmarked link to WatchGuard’s official software portal at software.watchguard.com instead of a search-result download page.