article thumbnail

Cuttlefish malware targets enterprise-grade SOHO routers

Security Affairs

The malware creates a proxy or VPN tunnel on the compromised router to exfiltrate data, and then uses stolen credentials to access targeted resources. The malicious code can also perform DNS and HTTP hijacking within private IP spaces. . The recent campaign spanned from October 2023 to April 2024. ” concludes the report.

Malware 106
article thumbnail

Overview of IoT threats in 2023

SecureList

We conducted an analysis of the IoT threat landscape for 2023, as well as the products and services offered on the dark web related to hacking connected devices. In the first half of 2023, 97.91% of password brute-force attempts registered by our honeypots targeted Telnet, and only 2.09%, SSH.

IoT 99
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

VulnRecap 2/19/2024: News from Microsoft, Zoom, SolarWinds

eSecurity Planet

Appliances with affected software must have Anyconnect SSL VPN enabled on whichever interface is exposed to the internet for an attack to occur. Palo Alto’s Unit 42 research team said that Akira led the number of ransomware posts from new leak sites in 2023. The vulnerability, CVE-2020-3259 , was first discovered in May 2020.

VPN 113
article thumbnail

FIN8-linked actor targets Citrix NetScaler systems

Security Affairs

A financially motivated actor linked to the FIN8 group exploits the CVE-2023-3519 RCE in attacks on Citrix NetScaler systems in massive attacks. The hackers are exploiting the remote code execution, tracked as CVE-2023-3519 , in a large-scale campaign. The flaw CVE-2023-3519 (CVSS score: 9.8) php) on victim machines.

VPN 107
article thumbnail

CISA warns of attacks against Citrix NetScaler ADC and Gateway Devices

Security Affairs

Cybersecurity and Infrastructure Security Agency (CISA) warning of cyber attacks against Citrix NetScaler Application Delivery Controller (ADC) and Gateway devices exploiting recently discovered zero-day CVE-2023-3519. “Exploits of CVE-2023-3519 on unmitigated appliances have been observed.

VPN 83
article thumbnail

ToddyCat is making holes in your infrastructure

SecureList

A connection like this created on domain controllers allows attackers to obtain the IP addresses of hosts on the internal network through DNS queries. Diagram of SSH tunnel creation SoftEther VPN The next tool that the attackers used for tunneling was the server utility (VPN Server) from the SoftEther VPN package.

VPN 119
article thumbnail

How to Prevent DNS Attacks: DNS Security Best Practices

eSecurity Planet

Domain name service (DNS) attacks threaten every internet connection because they can deny, intercept, and hijack connections. With the internet playing an increasing role in business, securing DNS plays a critical role in both operations and security. Everything You Need to Know.

DNS 113