KBA 135412 SQL Injection -- Sophos please specify ASAP "user accounts used for remote access"

Question

Hi, 
 After carefully studying logfiles and doing a postgres db dump, we sadly notice that there are indications of an sql injection attack on the firewall. 
 In the KBA we were told that credentials like "user accounts used for remote access" are exposed. 
 After further studying of db dump we see that SITE TO SITE IPSEC PSK are saved in the database too. 
 Please specify asap if this Data was also exposed or not, as we have to inform customers and their partners using s2s vpn with psk. 
 
 thanks 
 heinz

FloSupport · Answer

After analyzing the components and intent of the attack, Sophos published a SophosLabs Uncut article, &ldquo;Asnarok&rdquo; Trojan targets firewalls , to share its current understanding of the malware.