Spiceworks also hit by same attack as Solarwinds?

[AaronK123]

Does anyone know if Spiceworks (also a monitoring platform) was hit by the same "vulnerability" as Solarwinds? Right now everyone is tightlipped about it.

All I know is that my firewall noticed pings from my Spiceworks server to one of the flagged domains the Solarwinds attack used. We've shut down the server (planning on retiring at some point anyways) and we don't see any evidence of an attack, but I wonder if this attack is more widespread then is being let on at this point.

 

[MichaelRSorg]

Why not leave the Spiceworks server up and log all outbound requests it makes? Of course isolate it in its own VLAN too.

 

[AaronK123]

Well, we did some follow up work on this.

The IP our firewall was detecting is a known malware blackhole from the firewall vendor (they will transpose it in as necessary).

During its scheduled scans, the Spiceworks server was pinging the IP to see if it was up. Not sure why, but it was. At this point, we think this is a huge false positive.