This article concerns the incident disclosed by AnyDesk on February 2, 2024. It does not describe a newly reported incident. It is based on AnyDesk’s official statement.
Remote desktop tools make it possible to access a computer from another location. When a provider reports a security incident, users understandably want to know what happened and whether their accounts or devices were affected.
What happened?
AnyDesk said that, after detecting indications of an incident and conducting a security audit, it found evidence that its production systems had been compromised. The company said it activated a response plan with cybersecurity firm CrowdStrike and notified the relevant authorities. It also said the incident was not related to ransomware.
Read AnyDesk’s February 2, 2024 statement
How did AnyDesk respond?
According to the statement, the company revoked security-related certificates and remediated or replaced systems where necessary. It had also begun replacing the previous code-signing certificate used for its software. A code-signing certificate helps identify the software’s publisher.
As a precaution, AnyDesk said it was revoking customer web portal passwords and recommended changing the password on other services if it had been reused. It advised users to install the latest version with the new signing certificate. These were the steps described in the 2024 statement; consult the provider’s current guidance for current releases and procedures.
Were user devices compromised?
At the time of its statement, AnyDesk said it had no evidence that end-user devices had been affected. This reflects the company’s finding at that point. The statement does not establish that all customer devices were compromised, and it is not a guarantee about any individual environment.
If you suspect an unauthorized connection or actual harm, manage the affected device and network safely and contact your organization’s security team or the service provider.
A security checklist for remote access
- Update through official channels. Check the vendor’s current releases and security notices. Avoid installation files or attachments from unknown sources.
- Protect accounts. Use a unique, strong password for each service and enable two-factor authentication where available. Change reused passwords on other accounts.
- Review permissions. Do not approve unexpected connection requests. Remove accounts and shared access that are no longer needed.
- Check unattended access and activity. Enable unattended access only where necessary, and review available session history and active connections.
- Watch for impersonation. Verify messages that pressure you to install software or enter a password through a known official support channel.
Remote access security depends on regular attention to devices, accounts and permissions. Check the date and scope of any advisory before applying it to your environment.
Sources
- AnyDesk Incident Response, February 2, 2024
- CERT-FR security alert and updates
- AnyDesk logo in the illustrations: AnyDesk logo on Wikimedia Commons, preserved from the AnyDesk website. AnyDesk is a trademark of its owner. This informational article was independently prepared by AirDesk.
