TeamViewer Confirms Undisclosed Breach From 2016

TeamViewer confirmed this week that it has been the victim of a cyber attack which was discovered during the autumn of 2016 but was never disclosed. This attack is thought to be of Chinese origins and utilized the Winnti backdoor.
The company behind the highly popular TeamViewer remote desktop software told German publisher Der Spiegel that the attack was discovered before the threat group was capable of doing any damage, with experts and investigators failing to find any evidence of data being stolen during the security incident.
Also, no evidence was found that the hackers were able to compromise or steal source code even though they had access to it, according to TeamViewer.
Backdoors which might have been planted during the 2016 attack have also been removed after a data centre overhaul and all systems "completely checked, cleaned up and repositioned" at the end of 2016 according to the Der Spiegel report.
When asked by BleepingComputer about when and how the breach was discovered, TeamViewer said they detected the attack before any major damage was done.
"Like many technology leaders, TeamViewer is frequently confronted with attacks by cybercriminals. For this reason, we continuously invest in the advancement of our IT security and cooperate closely with globally renowned experts and institutions in this field.
In autumn 2016, TeamViewer was a target of a cyber-attack. Our systems detected suspicious activities in time to prevent any major damage. An expert team of internal and external cyber security researchers, working together closely with the responsible authorities, successfully fended off the attack."
Seeing that the hackers were not able to steal any data during the attack, TeamViewer decided not to publish a security breach notification to inform the users of the incident.
Regarding the reasons behind the decision to not disclose the breach, a TeamViewer spokesperson further told BleepingComputer that based on consultation with relevant authorities and advisors, it was decided that it was not necessary to disclose the attack.
Independent experts conducted a thorough investigation using all IT forensic resources available and found no evidence that the security of our users or their IT systems was affected in any way.
Together with the relevant authorities and our security advisors, we came to the joint conclusion that informing our users was not necessary and would have been counterproductive to the effective prosecution of the attackers. Against this backdrop, we decided not to disclose the incident publicly in the interest of the global fight against cybercrime and thus also in the interest of our users.
Attackers have also used the Winnti malware against ThyssenKrupp in 2016 and Bayer in 2018, with ThyssenKrupp CERT investigators monitoring their activity and discovering that the hackers were only interested in stealing technical trade secrets.
In the case of the attack against the largest drugmaker from Germany, investigators from the DCSO cybersecurity group — set up by Bayer with help from Allianz, BASF and Volkswagen — were also able to keep an eye on the group's activity since the initial infiltration in early-2018 until March 2019 and also concluded that the hackers were not able to steal any data.
Service outage due to DoS attack during the summer of 2016
On June 1, 2016, TeamViewer issued a press release acknowledging a service outage caused by a denial-of-service attack (DoS) which targeted the TeamViewer DNS server infrastructure.
This statement followed multiple user reports claiming that attackers took control of their computers using TeamViewer and using their PayPal accounts to either make online purchases or steal money — a list was also created to track all the reported incidents.
Some of the victims also claimed that the attackers successfully compromised their TeamViewer accounts even though they used unique very long passwords or had Two-Factor Authentication enabled, leading them to believe that TeamViewer's computing systems were hacked [1, 2, 3].
However, in their press release, TeamViewer blamed the account hacks reported by its users on "Careless use of account credentials remains to be a key problem for all internet services. This particularly includes the use of the same password across multiple user accounts with various internet services."
TeamViewer also mentioned the possibility of some users having unintentionally downloaded and installed programs infected with malware which could have allowed attackers to "virtually do anything with that particular system – depending on how intricate the malware is, it can capture the entire system, seize or manipulate information, and so forth."
After the user uproar caused by the "careless" word used in the June 1 press release, Teamviewer apologized for using the word through public relation manager, Axel Schmidt.
TeamViewer also stated that the hacks reported by users might have had something to do with the Backdoor. TeamViewer malware besides the initial mention of stolen password credentials.
When asked if there is any connection between the account hacks reported in 2016 and the just disclosed breach, TeamViewer told BleepingComputer that there is no connection.
No. The cyber-attack on TeamViewer is in no way connected to this.
The corresponding reports are presumably related to a theft of large amounts of data from popular internet services (e.g. LinkedIn) in the same year. If affected users had been using identical passwords for third-party services, such as TeamViewer, it was possible for attackers to abuse them for unauthorized access attempts.
TeamViewer generally recommends using unique passwords for different services and setting up a two-factor authentication to effectively prevent this kind of attack.
The Winnti Umbrella
While there is no attribution for the hacking group behind the 2016 attack TeamViewer just confirmed, multiple hacking groups collectively known by experts as the Winnti Umbrella according to ProtectWise 401 TRG, have been using the Winnti malware during their attacks.
The groups come under various names (i.e.,Winnti Group, PassCV, APT17, Axiom, LEAD, BARIUM, Wicked Panda, and GREF) but Winnti Group is the first known to have used the Winnti backdoor during their campaigns.
As Kaspersky's GReAT full report on the Winnti Group from 2013 says, "The main objective of the group is to steal source code of online game projects as well as digital certificates of legitimate software vendors."
BARIUM, another Winnti Umbrella threat group, which mainly targets software and gaming companies [1, 2] and is still active as shown by its involvement in Operation ShadowHammer could be the most probable candidate for this attack.
Kaspersky also found evidence that connected the methods and tools used as part of Operation ShadowHammer with the ones employed in the supply chain attacks against CCleaner and NetSarang from 2017, with the threat actor behind the latter already having been identified as BARIUM by ESET, Microsoft, and other security researchers.
source bleepingcomputer
Industry: Cyber Security News

Latest Jobs
-
- Account Manager - IT Services
- Germany
- €90000 plus OTE and Car
-
Are you a deal closer with a hunter mindset? Do you know how to uncover business pain points, and turn them into long-term digital transformation partnerships? Our Client are growing their sales force across Germany and looking for an ambitious, straight-talking Account Manager to take the lead on new client acquisition. You’ll focus on mid-sized to large enterprises across Germany helping to shape their digital future with tailored IT solutions in Workplace, Cloud, and Security. • Drive Growth: Own the full sales cycle for new business across your region. • Solution Sell: Build bespoke offers in Security, Digital Workplace and Cloud solutions • Build Relationships: Establish a solid pipeline through smart prospecting, marketing-driven leads, and your own network. • Represent a brand known for trust, delivery, and tech excellence—with 4,000 employees globally and a growing team within Germany. What You Bring • Proven new logo sales experience in the IT services space (not hardware!) • Deep knowledge in one or more of: Cybersecurity, Digital Workplace, or Cloud • Confidence to lead enterprise deals and pitch directly to senior stakeholders • Fluent German and good English skills Sind Sie ein Abschlussprofi mit Hunter-Mentalität? Wissen Sie, wie man geschäftliche Pain Points identifiziert und in langfristige Partnerschaften zur digitalen Transformation verwandelt? Unser Kunde baut derzeit sein Vertriebsteam in ganz Deutschland aus und sucht eine ambitionierte, ehrliche Persönlichkeit als Account Manager, die den Lead bei der Neukundengewinnung übernimmt. Ihr Fokus liegt auf mittelständischen bis großen Unternehmen in Deutschland, denen Sie mit maßgeschneiderten IT-Lösungen in den Bereichen Workplace, Cloud und Security den Weg in die digitale Zukunft ebnen. Ihre Aufgaben • Wachstum vorantreiben: Verantwortung für den gesamten Vertriebszyklus im Neugeschäft Ihrer Region. • Lösungsorientierter Vertrieb: Entwicklung individueller Angebote in den Bereichen Security, Digital Workplace und Cloud-Lösungen. • Beziehungen aufbauen: Aufbau einer stabilen Pipeline durch gezielte Ansprache, marketinggenerierte Leads und Ihr eigenes Netzwerk. • Marke repräsentieren: Werden Sie Teil eines Unternehmens mit 4.000 Mitarbeitenden weltweit und einem stark wachsenden Team in Deutschland – bekannt für Vertrauen, Verlässlichkeit und technologische Exzellenz. Was Sie mitbringen • Nachgewiesene Erfahrung in der Neukundenakquise im Bereich IT-Services (kein Hardwarevertrieb!) • Fundiertes Wissen in mindestens einem der Bereiche: Cybersecurity, Digital Workplace oder Cloud • Selbstbewusstes Auftreten im Umgang mit Enterprise-Deals und Entscheidungsträgern auf Top-Level • Verhandlungssichere Deutschkenntnisse und gute Englischkenntnisse
-
- Senior SOC Analyst Level 3. Microsoft Security stack | Ability to achieve SC Clearance
- London
- To attract the right person
-
Job Title: Senior SOC Analyst Level 3. Microsoft Security stack | Ability to achieve SC Clearance Location: Hybrid remote | London / Berkshire Overview: Senior SOC Analyst Level 3 to join a specialist Managed Security Services business. You will be responsible for advanced threat hunting / triage, incident response etc with a strong focus on the Microsoft Security Stack. Key Responsibilities: Lead and resolve complex security incidents / escalations Conduct advanced threat hunting using the Microsoft Security Stack. Build, optimise and maintain workbooks, rules, analytics etc. Correlate data across Microsoft 365 Defender, Azure Defender and Sentinel. Perform root cause analysis and post-incident reporting. Aid in mentoring and upskilling Level 1 and 2 SOC analysts. Required Skills & Experience: The ability to achieve UK Security Clearance (SC) – existing clearance ideal. (Sorry no visa applications) Current experience working with a SOC environment Microsoft Sentinel: Development and tuning of custom analytic rules. Workbook creation and dashboarding. Automation using Playbooks and SOAR integration. Kusto Query Language (KQL): Writing complex, efficient queries for advanced threat hunting and detection. Correlating data across key tables (e.g., SignInLogs, SecurityEvent, OfficeActivity, DeviceEvents). Developing custom detection rules, optimising performance, and reducing false positives. Supporting Sentinel Workbooks, Alerts, and Playbooks through advanced KQL use. Deep understanding of incident response, threat intelligence and adversary techniques (MITRE ATT&CK framework). Strong knowledge of cloud and hybrid security, particularly within Azure. Additional Requirements: Must hold or be eligible to achieve a minimum of Security Clearance (SC) level. Nice to have certifications (e.g., SC-200, AZ-500, GIAC) are desirable. Strong problem-solving and analytical skills. Excellent communication for clear documentation and team collaboration. Please follow Wheaton’s Law.
-
- New Business Sales Hunter | Cyber Security (UK Based)
- London
- To attract the right person
-
New Business Sales Hunter needed | Cybersecurity (UK Based) Are you looking for uncapped commission, a fun and sociable team that drives success with no politics? If so...You must Be UK based - and able to achieve UK SC clearance. (sorry no visas) Have a demonstrable history of sales success in Cyber Security Follow Weatons law. The role: Seeking a proven New Business Sales Hunter to join an established, successful and expanding cyber security firm. New business focused - £1m GP year one target (ramped). Sell a blend of security services & professional services. Ideal experience selling some or all of the following Cyber strategy & risk management Managed detection & response (MDR) Penetration testing Compliance & audit support You: Strong cybersecurity/IT services sales track record. Confident selling into mid-market & enterprise. UK based - London commutable 1x per week. Hunter mindset, full sales cycle ownership. Don't just send an email to apply give me a call on 07884666351
-
- CyberArk Architect
- London
- Upto £110,000 plus bonus and benefits
-
Are you ready to lead from the front and drive innovation in the Identity & Access Management (IAM) space? We’re looking for a seasoned CyberArk Architect who has CDE-CPC ideally or experience with privilege Cloud, someone who can lead with vision, execute with precision, and inspire teams to deliver excellence. As a key leader in our organisation, you’ll bring your strong business acumen and a technology-focused, innovative mindset to the table. You’ll be driving strategic initiatives, shaping transformation programs, and empowering teams to think big and deliver even bigger. Acting as a subject matter expert in CyberArk Leading strategic transformations in: Identity Governance Privileged Access Management (PAM) Access Management Customer Identity and Access Management (CIAM) Building and maintaining strong, collaborative relationships within the team Communicating clearly and confidently — both written and verbal — to deliver updates, raise potential issues, and share insights If you are interested in the above position we are looking for people with: deep expertise and a successful track record in IAM strategy, delivery, or assurance with CyberArk Hold relevant certifications such as CDE in Privileged Cloud or Guardian Have experience in a client-facing role (preferred, but not essential) Thrive in a hybrid working environment and are available to work from our or client London office three days a week Lead with clarity, communicate with impact, and adapt quickly to changing priorities