Russian cybersecurity firm Dr.Web suffers cyberattack, temporarily suspends virus database updates

Russian anti-malware company Doctor Web (Dr.Web) disclosed a cyberattack targeting its IT infrastructure over the weekend. The company detected "signs of unauthorized interference" on Saturday, September 14, 2024, prompting an immediate response to secure its systems.

 

To contain the breach, Dr.Web disconnected all servers from its internal network and paused virus database updates on Monday as part of a comprehensive investigation into the security incident. The company reassured its users that the situation was quickly brought under control and that no customer systems protected by Dr.Web were affected.

 

In a statement on its official website, Dr.Web confirmed that the attempted attack had been thwarted in time, adding, "The attempt to harm our infrastructure was prevented promptly." The company followed its security protocols, disconnecting its servers and conducting a detailed security diagnostic to assess the damage and eliminate any lingering threats.

 

By Tuesday, Dr.Web had resumed its virus database updates after implementing a series of protective measures, including using its proprietary tool, Dr.Web FixIt! for Linux. The data gathered during the incident helped the company’s security experts isolate the threat and ensure its customers remained unaffected.

 

Dr.Web, a prominent player in Russia’s cybersecurity industry, is the latest in a series of firms facing cyberattacks. Russian security companies, such as Avanpost and Kaspersky, have also been targeted recently. For example, in June 2024, pro-Ukrainian hackers known as Cyber Anarchy Squad breached Avanpost, stealing 390GB of data and encrypting 400 virtual machines. Similarly, Kaspersky revealed in June 2023 that its iPhones were infected with spyware through iMessage zero-click exploits as part of Operation Triangulation. This campaign began in 2019 and continues to affect its global offices.