article thumbnail

Muddling Meerkat, a mysterious DNS Operation involving China’s Great Firewall

Security Affairs

The China-linked threat actors Muddling Meerkat are manipulating DNS to probe networks globally since 2019. Infoblox researchers observed China-linked threat actors Muddling Meerkat using sophisticated DNS activities since 2019 to bypass traditional security measures and probe networks worldwide.

DNS 116
article thumbnail

Black Hat USA 2021 Network Operations Center

Cisco Security

This requires a robust connection to the Internet (Lumen and Gigamon), firewall protection (Palo Alto Networks), segmented wireless network (Commscope Ruckus) and network full packet capture & forensics and SIEM (RSA NetWitness); with Cisco providing cloud-based security and intelligence support. From Russia With Love. Recorded Future.

DNS 136
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Patrick Wardle on Breaking and Bypassing MacOS Firewalls

Threatpost

A Black Hat talk demonstrates the ease of poking holes in firewalls: How to break, bypass and dismantle macOS firewall products.

article thumbnail

Microsoft releases open-source tool for checking MikroTik Routers compromise

Security Affairs

The attack chain against the routers starts with brute-force attacks or by exploiting the CVE-2018-14847 flaw that allows reading a file that contains passwords. Microsoft has analyzed how the malware compromised MikroTik routers and developed a tool to detect signs of compromise. Follow me on Twitter: @securityaffairs and Facebook.

Malware 122
article thumbnail

French Firms Rocked by Kasbah Hacker?

Krebs on Security

In 2018, security intelligence firm HYAS discovered a malware network communicating with systems inside of a French national power company. When it didn’t hear from French authorities after almost a week, HYAS asked the dynamic DNS provider to “ sinkhole ” the malware network’s control servers. .

DNS 253
article thumbnail

Threat Protection: The REvil Ransomware

Cisco Security

We looked at REvil, also known as Sodinokibi or Sodin, earlier in the year in a Threat Trends blog on DNS Security. In it we talked about how REvil/Sodinokibi compromised far more endpoints than Ryuk, but had far less DNS communication. Figure 1-DNS activity surrounding REvil/Sodinokibi. Changing firewall rules.

article thumbnail

Threat Trends: Firewall

Cisco Security

In any perimeter defense a key component is firewalls—the proverbial guard towers in your fortifications. In this Threat Trends release, we’ll be looking at Cisco Secure Firewall. The goal is to highlight the common threats that organizations encounter and block with Secure Firewall. Secure Firewall version 7.0

Firewall 112