Huntress traced an Oct 7 MSP incident to an admin who Bing-searched "watchguard vpn sll download" and landed on watchguard-vpn[.]net, which Huntress classifies as SEO poisoning. When the admin clicked download, a popup.js modal asked for Server, Login and Password. It always rejects the first submission to harvest a second credential set, then POSTs JSON to watchguard-ssl[.]online. After that it downloads the real Authenticode-signed WG-MVPN-SSL 12.11.5 from cdn.watchguard.com, so there is no malicious file for EDR to catch. The detection surface is browser, DNS and VPN-auth logs. IOCs: 80.249.132[.]140 (lure) and 158.94.209[.]19 (collector). Response: reset any credentials entered, enforce MFA on SSL VPN, and publish the official download link (software.watchguard.com).

// KQL sketch: lure/collector contact, then VPN logins from new ASNs
let iocs = dynamic(["watchguard-vpn.net","watchguard-ssl.online"]);
DeviceNetworkEvents
| where RemoteUrl has_any (iocs) or RemoteIP in ("80.249.132.140","158.94.209.19")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
// then pivot: Firebox SSL-VPN auth logs for those users from hosting ASNs / never-seen countries