Security Affairs

APRIL 6, 2020

DarkHotel nation-state actor is exploiting a VPN zero -day to breach Chinese government agencies in Beijing and Shanghai. State-sponsored hackers used a zero-day vulnerability in Sangfor SSL VPN servers to gain access to victims’ networks. Up to now, a large number of VPN users have been attacked.” are vulnerable.

VPN 122

VPN Government Advertising Firmware 122

Security Affairs

JUNE 4, 2023

Zyxel has published guidance for protecting firewall and VPN devices from the ongoing attacks recently discovered. Zyxel has published guidance for protecting firewall and VPN devices from ongoing attacks exploiting CVE-2023-28771 , CVE-2023-33009 , and CVE-2023-33010 vulnerabilities. Patch 2 VPN ZLD V4.60 Patch 1 ZLD V5.36

Firmware 79

Firmware VPN Firewall Hacking 79

Security Affairs

JUNE 1, 2023

Threat actors are actively exploiting a command injection flaw, tracked as CVE-2023-28771, in Zyxel firewalls to install malware. Their objective is to leverage this vulnerability to deploy and install malware on the affected systems. “Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60

Firewall 87

Firewall Firmware VPN DDOS 87

Krebs on Security

JUNE 15, 2023

But last week, Barracuda took the highly unusual step of offering to replace compromised ESGs , evidently in response to malware that altered the systems in such a fundamental way that they could no longer be secured remotely with software updates. “They sold so many VPNs through the pandemic and this is the hangover,” Gray said.

Risk 221

Risk VPN Internet Internet 221

Krebs on Security

FEBRUARY 26, 2020

. “We’ve now completed the investigation of all Zyxel products and found that firewall products running specific firmware versions are also vulnerable,” Zyxel wrote in an email to KrebsOnSecurity. “Hotfixes have been released immediately, and the standard firmware patches will be released in March.”

Firewall 263

Firewall Firmware VPN IoT 263

Security Affairs

JUNE 20, 2023

The vulnerability is a pre-authentication command injection issue that impacts the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, 14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, 11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0. ” reads the advisory published by Zyxel.

Firmware 85

Firmware Firewall Authentication VPN 85

Security Affairs

JULY 22, 2023

The cause of the vulnerability is the improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35.

DDOS 93

DDOS Firmware VPN Firewall 93

eSecurity Planet

JANUARY 16, 2024

January 10, 2024 Thousands of WordPress Sites Vulnerable to Malware Injection Type of vulnerability: Cross-site scripting flaw in Popup Builder that allows a malware injection. The problem: Ivanti announced two vulnerabilities that affect Ivanti Connect Secure VPN and Ivanti Policy Secure products. Versions 9.x 20240107.1.xml

Firewall 107

Firewall Firmware IoT Authentication 107

Security Affairs

JULY 18, 2021

x firmware in an imminent ransomware campaign using stolen credentials.” The exploitation targets a known vulnerability that has been patched in newer versions of firmware.”. The network equipment vendor is now urging customers to update the firmware of their devices as soon as possible. reads the alert published by the company.

Ransomware 109

Ransomware Firmware Mobile InfoSec 109

eSecurity Planet

JANUARY 22, 2024

This week’s vulnerability news include GitHub credential access, a new Chrome fix, and hidden malware from pirated applications hosted on Chinese websites. The problem: The Unified Extensible Firmware Interface (UEFI) specification has an open-source network implementation, EDK II, with nine discovered vulnerabilities.

Authentication 111

Authentication Malware VPN Mobile 111

Security Affairs

JANUARY 6, 2021

The Taiwanese vendor Zyxel has recently addressed a critical vulnerability in its firmware, tracked as CVE-2020-29583 , related to the presence of a hardcoded undocumented secret account. Firmware version 4.60 The password for this account can be found in cleartext in the firmware.” reads the advisory published by NIST.

Firmware 106

Firmware Passwords Accountability VPN 106

Security Affairs

MAY 1, 2021

If you must connect your NAS to the internet, we highly recommend using a trusted VPN or a myQNAPcloud link.” ” QNAP NAS devices continue to be under attack, earlier March, researchers at 360Netlab warned of a cryptocurrency malware campaign targeting unpatched QNAP network-attached storage (NAS) devices.

Ransomware 107

Ransomware Cryptocurrency Malware Internet 107

Security Affairs

DECEMBER 22, 2022

Zerobot operators are offering the botnet as a malware-as-a-service model, one domain (zerostresser[.]com) the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. The IT giant is tracking this cluster of threat activity as DEV-1061.

IoT 112

IoT DDOS Malware Firmware 112

eSecurity Planet

MAY 20, 2024

Microsoft Patch Tuesday takes center stage in this week’s vulnerability news, with a notable SharePoint Server vulnerability that’s been seen alongside Qakbot malware. This one has been active in the wild; SecureList found it to be in use with Qakbot and other strains of malware.

VPN 60

VPN Firmware Malware Software 60

Security Affairs

OCTOBER 22, 2022

The Daixin Team group gains initial access to victims through virtual private network (VPN) servers. In one successful attack, the attackers likely exploited an unpatched vulnerability in the organization’s VPN server. In another compromise, the group leveraged on compromised credentials to access a legacy VPN server.

Ransomware 65

Ransomware VPN Cybercrime Accountability 65

Approachable Cyber Threats

JANUARY 17, 2023

A publicly available network may not always have the latest firmware, patch updates on its hardware, or have proper encryption enabled; therefore, if you connect to the network you may be exposing yourself to potential risks. Most likely, it is free and faster than using the data from our phone plan. What are the potential risks?”

Encryption 98

Encryption Internet Internet VPN 98

eSecurity Planet

MAY 3, 2022

The goal is to redirect the victims to rogue servers owned by the hackers to steal credentials or install malware. According to the researchers, the affected devices are “well-known IoT devices running the latest firmware.” Admins need to apply the latest updates to all vendors and watch for the next firmware releases.

DNS 129

DNS Risk Firmware IoT 129

Security Affairs

APRIL 25, 2022

The BlackCat/ALPHV a Ransomware was first discovered in December by malware researchers from Recorded Future and MalwareHunterTeam. The malware is the first professional ransomware strain that was written in the Rust programming language. Install and regularly update antivirus and anti-malware software on all hosts.

Ransomware 98

Ransomware Antivirus Passwords Malware 98

SecureWorld News

OCTOBER 8, 2023

Use the administrator account only for maintenance, software installation, or firmware updates. Attention should be paid to protecting routers and updating their firmware. While OS updates are now commonly practiced, router firmware updates remain an overlooked aspect. Opt for strong, hard-to-crack passwords.

Firmware 84

Firmware IoT Accountability Passwords 84

Security Affairs

SEPTEMBER 15, 2020

7 ] CVE-2019-19781 : Citrix Virtual Private Network (VPN) Appliances – CISA has observed the threat actors attempting to discover vulnerable Citrix VPN Appliances. Citrix blog post: firmware updates for Citrix ADC and Citrix Gateway versions 12.1 CVE-2019-19781 enabled the actors to execute directory traversal attacks.[

Government 69

Government VPN Firmware Energy and Utilities 69

Security Boulevard

MARCH 15, 2022

The ransomware group specified that “they are not looking for data” but rather to buy remote VPN access to the corporate network. Attackers can use the compromised code signing certificates to sign malware, so it will appear to be legitimate and trustworthy and escape security solutions to be loaded and executed.

Ransomware 128

Ransomware Telecommunications Firmware Media 128

eSecurity Planet

MARCH 21, 2022

They then authenticated to the victim’s VPN to initiate a remote desktop protocol (RDP) connection to the domain controllers. Update software, including operating systems, applications, and firmware on IT network assets in a timely manner. When possible, implement multi-factor authentication on all VPN connections.

VPN 114

VPN Accountability Authentication Passwords 114

eSecurity Planet

MAY 28, 2021

Malware detection has long been a game of signature detection. With ML and artificial intelligence (AI) using thousands of strains to train algorithms, one would surmise that the ability to detect malware is only improving. Hackers are using the same ML and AI technology to avoid using recognized malware. Current Target: VBOS.

Software 116

Software Firmware DNS VPN 116

Security Affairs

MARCH 26, 2021

Mamba ransomware is one of the first malware that encrypted hard drives rather than files that was detected in public attacks. Install updates/patch operating systems, software, and firmware as soon as they are released. • Install and regularly update anti-virus and anti-malware software on all hosts.

Ransomware 143

Ransomware Encryption Passwords Malware 143

Security Affairs

MARCH 19, 2022

“As a result, AvosLocker indicators of compromise (IOCs) vary between indicators specific to AvosLocker malware and indicators specific to the individual affiliate responsible for the intrusion.” Install updates/patch operating systems, software, and firmware as soon as updates/patches are released.

Ransomware 92

Ransomware DDOS Passwords Backups 92

Security Affairs

APRIL 11, 2021

Clop Ransomware operators plunder US universities Malware attack on Applus blocked vehicle inspections in some US states 2,5M+ users can check whether their data were exposed in Facebook data leak 33.4% Every week the best security articles from Security Affairs free for you in your email box.

Cyber Attacks 53

Cyber Attacks Firmware Malware VPN 53

Security Affairs

NOVEMBER 29, 2020

Experts was that vendors may have bought vulnerable versions of this stack before the 2012 update and are still using it in their firmware. “However, many vendors may have bought vulnerable versions of this stack prior to the 2012 update, starting in the early 2000s when it was first issued, and integrated it into their own firmware.

Hacking 119

Hacking Firmware Internet Internet 119

Security Affairs

FEBRUARY 11, 2019

Users of the Network attached storage devices manufactured have reported a mystery string of malware attacks that disabled software updates by hijacking entries in host machines’ hosts file. “Since recent firmware updates, the ClamAV Antivirus fails to update due to 700+ clamav.net entries in /etc/hosts, all set to 0.0.0.0

Antivirus 90

Antivirus Firmware Advertising VPN 90

Security Affairs

APRIL 25, 2019

. “An open redirect vulnerability could allow a remote unauthenticated attacker to input a malicious link to redirect users to a malicious site that could run or download arbitrary malware on the user’s machine.” This malicious website could potentially run or download arbitrary malware on the user’s machine.

Firmware 72

Firmware Social Engineering Advertising Malware 72

Malwarebytes

MARCH 17, 2021

PYSA, aka Mespinoza, is a malware capable of exfiltrating data and encrypting users’ critical files and data stored on their systems. To prevent attacks: Install security updates for operating systems, software, and firmware as soon as they are released. Use up-to-date anti-virus and anti-malware software on all hosts.

Education 106

Education Ransomware Phishing Passwords 106

SecureList

NOVEMBER 14, 2022

This reveals a likely blind spot for defenders and endpoint vendors: in a number of cases, perhaps even the majority, attackers have no need for 0-days and malware deployment to gain access to the information they need. One of the major cyber-incidents of 2022 took place early this year: the Okta hack.

Firmware 110

Firmware Surveillance Mobile Telecommunications 110

Malwarebytes

JUNE 26, 2023

Microsoft claims to have traced this particular campaign to a member of a hacking forum who offers several tools for sale in what may be a dedicated malware as a service operation. Maintain device health with updates: Make sure devices are up to date with the latest firmware and patches.

IoT 80

IoT Adware Firmware DDOS 80

SiteLock

AUGUST 27, 2021

To help avoid these online risks, it is highly recommended to use a Virtual Private Network (VPN). VPNs are the baseline cybersecurity tool to safeguard internet-enabled devices and a home network. A VPN provides a secure internet connection, ensuring your browsing data is encrypted for maximum privacy and security.

IoT 98

IoT Spyware VPN Passwords 98

Security Affairs

SEPTEMBER 3, 2021

Install updates/patch operating systems, software, and firmware as soon as they are released. Install and regularly update anti-virus and anti-malware software on all hosts. Consider installing and using a VPN. hard drive, storage device, the cloud). Use multifactor authentication with strong pass phrases where possible.

Ransomware 91

Ransomware Passwords Backups Firmware 91

Krebs on Security

MAY 22, 2023

Very often, this proxy software is installed surreptitiously, such as through a “Free VPN” service or mobile app. Residential proxies also can refer to households protected by compromised home routers running factory-default credentials or outdated firmware. “Consider salaries in Russia,” Quotpw said.

Scams 252

Scams DDOS Cryptocurrency Accountability 252

CyberSecurity Insiders

NOVEMBER 1, 2022

Back then, endpoint security focused on computers, which meant the installation of antivirus, malware protection, firewall, and (sometimes) VPN in every computer. They are designed to detect and block file-based malware attacks, examine network activities for malicious operations, and facilitate incident investigation and remediation.

IoT 120

IoT Antivirus Threat Detection Cyber threats 120

Malwarebytes

SEPTEMBER 3, 2021

Rise in malware. As we pointed out in our State of Malware report, published earlier this year, Malwarebytes recorded an eye-watering 607% increase in malware detections in the agriculture sector in 2020. Install updates/patch operating systems, software, and firmware as soon as they are released.

Ransomware 138

Ransomware Manufacturing Passwords Internet 138