article thumbnail

Approximately 2000 Citrix NetScaler servers were backdoored in a massive campaign

Security Affairs

The company added that successful exploitation requires that the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. The IT giant warns of the availability of exploits for this vulnerability that have been observed in attacks against unmitigated appliances.

article thumbnail

Security Affairs newsletter Round 457 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

Clorox estimates the costs of the August cyberattack will exceed $49 Million Mastodon fixed a flaw that can allow the takeover of any account Iranian hackers breached Albania’s Institute of Statistics (INSTAT) Operation Synergia led to the arrest of 31 individuals Ex CIA employee Joshua Adam Schulte sentenced to 40 years in prison Cloudflare breached (..)

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Russia-linked Sandworm APT uses WinRAR in destructive attacks on Ukraine’s public sector

Security Affairs

The Sandworm group (aka BlackEnergy , UAC-0082 , Iron Viking , Voodoo Bear , and TeleBots ) has been active since 2000, it operates under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST). The attackers used a BAT script dubbed RoarBat that recursively searches for files with specific extensions (.doc,docx,rtf,txt,xls,xlsx,ppt,pptx,vsd,vsdx,pdf,png,jpeg,jpg,zip,rar,7z,mp4,sql

VPN 81
article thumbnail

Russia-linked Sandworm APT compromised 11 Ukrainian telecommunications providers

Security Affairs

The Sandworm group (aka BlackEnergy , UAC-0082 , Iron Viking , Voodoo Bear , and TeleBots ) has been active since 2000, it operates under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST). ” reads the advisory published by the CERT-UA. “Note (!)

article thumbnail

SonicWall warns of ‘imminent ransomware’ attacks on its EOL products

Security Affairs

Below the recommendations provided by the company: SRA 4600/1600 (EOL 2019) Disconnect immediately Reset passwords SRA 4200/1200 (EOL 2016) Disconnect immediately Reset passwords SSL-VPN 200/2000/400 (EOL 2013/2014) Disconnect immediately Reset passwords SMA 400/200 (Still Supported, in Limited Retirement Mode) Update to 10.2.0.7-34

Firmware 108
article thumbnail

France agency ANSSI links Russia’s Sandworm APT to attacks on hosting providers

Security Affairs

Sandworm (aka BlackEnergy and TeleBots) has been active since 2000, it operates under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST). This backdoor is version 3.1.4. At the time of this writing it is not clear if the hackers exploited a vulnerability in the Centreon software.

VPN 121
article thumbnail

Security Affairs newsletter Round 233

Security Affairs

Privilege Escalation flaw found in Forcepoint VPN Client for Windows. Study shows connections between 2000 malware samples used by Russian APT groups. Portugues hacker faces hundreds of Charges in Football Leaks case. Portuguese hacker faces hundreds of Charges in Football Leaks case. The Dumb-Proof Guide.