Security Affairs

JULY 1, 2019

Cyber Defense Magazine July 2019 Edition has arrived. Cyber Defense Magazine July 2019 Edition has arrived. Tips, tricks, ideas, secrets and insider information on the best practices in cybersecurity. SecurityAffairs – Cyber Defense Magazine, hacking). The post Cyber Defense Magazine – July 2019 has arrived.

DNS 67

DNS Advertising Firewall Mobile 67

Security Affairs

JULY 4, 2019

Researchers at Network Security Research Lab of Qihoo 360 discovered a Lua-based backdoor dubbed Godlua that targets both Linux and Windows systems. The peculiarity of this new piece of malware is the ability to communicate with C2 servers via DNS over HTTPS ( DoH ). com domain. ” states the analysis. Pierluigi Paganini.

DNS 81

DNS Malware Advertising DDOS 81

Security Affairs

SEPTEMBER 4, 2019

Cyber Defense Magazine September 2019 Edition has arrived. In addition, we’re shooting for 7x24x365 uptime as we continue to scale with improved Web App Firewalls, Content Deliver Networks (CDNs) around the Globe, Faster and More Secure DNS and CyberDefenseMagazineBackup.com up and running as an array of live mirror sites.

DNS 65

DNS Advertising Firewall Mobile 65

Security Affairs

AUGUST 1, 2019

Cyber Defense Magazine August 2019 Edition has arrived. In addition, we’re shooting for 7x24x365 uptime as we continue to scale with improved Web App Firewalls, Content Deliver Networks (CDNs) around the Globe, Faster and More Secure DNS and CyberDefenseMagazineBackup.com up and running as an array of live mirror sites.

DNS 66

DNS Advertising Firewall Mobile 66

Security Affairs

NOVEMBER 24, 2020

Crooks were able to trick GoDaddy staff into handing over control of crypto-biz domain names in a classic DNS hijacking attack. Crooks were able to hijack traffic and email to various cryptocurrency-related websites as a result of a DNS hijacking attack on domains managed by GoDaddy. SecurityAffairs – hacking, DNS hijacking).

Social Engineering 101

Social Engineering Engineering DNS Data breaches 101

Security Affairs

JANUARY 7, 2024

Between 2017 and 2019, the APT group mainly used DNS hijacking in its campaigns. Follow me on Twitter: @securityaffairs and Faceboo k and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, Sea Turtle) The researchers believe that the Turkey-linked APT Sea Turtle has been active since at least 2017.

Media 114

Media Accountability Telecommunications Government 114

Security Affairs

AUGUST 20, 2021

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware , it appeared on the threat landscape in late 2019. According to the researchers, in the last months of 2019, the botnet was mainly involved in DDoS attacks. .” SecurityAffairs – hacking, Mozi botnet). Pierluigi Paganini.

IoT 103

IoT DNS Manufacturing Firmware 103

Security Affairs

OCTOBER 5, 2020

The experts are monitoring the Mirai-based botnet since November 2019 and observed it exploiting two Tenda router 0-day vulnerabilities to spread a Remote Access Trojan (RAT). ” When the botnet was first detected in 2019, experts noticed it was exploiting the Tenda zero-day flaw tracked as CVE-2020-10987. Pierluigi Paganini.

IoT 139

IoT Firmware DNS Advertising 139

Security Affairs

DECEMBER 19, 2022

Researchers believe that at least five different merchants and exchanges were used to fund the Glupteba addresses since 2019. The experts used passive DNS records to uncover Glupteba domains and hosts and analyzed the latest set of TLS certificates used by the bot to figure out the infrastructure used by the attackers.

DNS 99

DNS Antivirus Cryptocurrency Software 99

Security Affairs

MARCH 20, 2020

In May 2019, the experts noticed that the group started using hacked email addresses of numerous high-profile targets to send credential spam messages. The group was observed using this scheme between 2019 and 2020, and according to the experts, most of the compromised email accounts belong to defense companies in the Middle East.

Phishing 136

Phishing Accountability Advertising DNS 136

Security Affairs

OCTOBER 28, 2020

At the end of 2019, researchers spotted a new TrickBot backdoor framework dubbed Anchor that was using the DNS protocol for C2 communications. Stage 2 Security researcher Waylon Grange first spotted the new Linux variant of Anchor_DNS in July and called it “Anchor_Linux.” SecurityAffairs – hacking, Trickbot).

DNS 104

DNS Banking Advertising IoT 104

Security Affairs

SEPTEMBER 8, 2019

Hi folk, let me inform you that I suspended the newsletter service, anyway I’ll continue to provide you a list of published posts every week through the blog. Cisco addresses CVE-2019-12643 critical flaw in virtual Service Container for IOS XE. Malspam campaign bypasses secure email gateway using Google Docs.

IoT 75

IoT Data breaches DNS Advertising 75

Security Affairs

JUNE 27, 2019

In April, the researcher Nick Cano discovered that BlueStacks versions prior than v4.90.0.1046 are affected by a DNS rebinding vulnerability that allowed attackers to gain access to the emulator’s IPC functions. BlueStacks addressed the flaw with the release 4.90.0.1046 available since May 27th, 2019.

DNS 85

DNS Backups Advertising Authentication 85

Security Affairs

JUNE 18, 2020

They use DNS tunneling for stealthier C&C communications, and place execution guardrails on the malicious components to hide the malware from security researchers.” Experts also observed attackers using a DNS downloader that was designed for long-term, covert access to the target machine. Pierluigi Paganini.

DNS 81

DNS Advertising Spyware Software 81

Security Affairs

NOVEMBER 19, 2020

Impacted systems included WordPress and DotNetNuke managed hosting platforms, online databases, email servers, DNS servers, RDP access points, and FTP servers. Our Technology and Information Security teams are working diligently to eliminate the threat and restore our customers to full capacity.” Pierluigi Paganini.

Ransomware 115

Ransomware DNS Encryption Hacking 115

Security Affairs

OCTOBER 20, 2021

China-linked cyberespionage group LightBasin hacked mobile telephone networks around the world and used specialized tools to access calling records. CrowdStrike researchers reported that at least 13 telecommunication companies were compromised by since 2019. SecurityAffairs – hacking, cyber security). Pierluigi Paganini.

Telecommunications 117

Telecommunications Mobile Hacking Architecture 117

Security Affairs

OCTOBER 29, 2020

In early 2019, researchers spotted a new TrickBot backdoor framework dubbed Anchor that was using the anchor_dns tool for abusing the DNS protocol for C2 communications. SecurityAffairs – hacking, ransomware). Several groups of experts linked both TrickBot and Ryuk threats to cybercrime gangs operating out of Russia. .

Healthcare 143

Healthcare Ransomware Cybercrime Advertising 143

Security Affairs

NOVEMBER 1, 2021

The number of infected devices is impressive, on 2019-11-30 a trusted security partner in the US informed Qihoo 360’s Netlab Cybersecurity reported to have observed 1,962,308 unique daily active IPs from the Pink botnet targeting its systems. SecurityAffairs – hacking, Pink botnet). Pierluigi Paganini.

Architecture 124

Architecture DDOS Advertising Firmware 124

Security Affairs

JULY 15, 2020

on the CVSS scale and affects Windows Server versions 2003 to 2019. Today we released an update for CVE-2020-1350 , a Critical Remote Code Execution (RCE) vulnerability in Windows DNS Server that is classified as a ‘wormable’ vulnerability and has a CVSS base score of 10.0. Non-Microsoft DNS Servers are not affected.”

DNS 60

DNS Advertising Engineering Internet 60

Security Affairs

OCTOBER 15, 2019

The cybercrime organization was first spotted in April 2018 by researchers at Cisco Talos, earlier 2019 researchers from Palo Alto Networks Unit42 found new malware samples used by the Rocke group for cryptojacking that uninstalls from Linux servers cloud security and monitoring products developed by Tencent Cloud and Alibaba Cloud.

Cybercrime 64

Cybercrime DNS Malware Advertising 64

Security Affairs

JULY 13, 2019

This year, security experts at Avast have blocked more than 4.6 The campaign uncovered by Avast aimed at silently modifying the Brazilian users’ Domain Name System (DNS) settings to redirect victims to malicious websites mimicking legitimate ones. Most recently, Netflix became a popular domain for DNS hijackers.”

DNS 74

DNS Passwords Advertising Banking 74

Security Affairs

DECEMBER 12, 2019

Microsoft experts reported that the GALLIUM hacking group exploits unpatched vulnerabilities to compromise systems running /JBoss application servers. link] — bk (Ben K) (@bkMSFT) December 12, 2019. The operators leverage on low cost and easy to replace infrastructure using dynamic-DNS domains and regularly reused hop points.

Telecommunications 67

Telecommunications DNS Malware Advertising 67

Security Affairs

FEBRUARY 8, 2022

Roaming Mantis surfaced in March 2018 when hacked routers in Japan redirecting users to compromised websites. Starting from April 2019, the campaign started using a new landing page to target iOS devices in the attempt to trick victims into installing a malicious iOS mobile configuration. SecurityAffairs – hacking, Roaming Mantis).

Phishing 87

Phishing DNS Malware Hacking 87

Security Affairs

JANUARY 14, 2021

The attacks share some similarities with other campaigns targeting Colombian entities, in particular a campaign detailed in February 2019, by QiAnXin. The threat actors also used dynamic DNS services to manage a pool of 70 different domain names (and also register new ones on a regular basis) that are dynamically assigned to IP addresses.

Malware 110

Malware Surveillance Phishing Government 110

Security Affairs

AUGUST 27, 2019

Security experts at Dragos Inc. According to Dragos, the Hexane group has been active since at least the middle of 2018, it intensified its activity since early 2019 with an escalation of tensions within the Middle East. The malware uses DNS and HTTP-based communication mechanisms. SecurityAffairs – Lyceum, hacking).

DNS 82

DNS Passwords Penetration Testing Social Engineering 82

Security Affairs

OCTOBER 20, 2021

SecurityAffairs – hacking, PurpleFox botnet). The post PurpleFox botnet variant uses WebSockets for more secure C2 communication appeared first on Security Affairs. Researchers from TrendMicro also shared a list of Indicators of Compromise for this threat. Follow me on Twitter: @securityaffairs and Facebook.

Encryption 89

Encryption DNS Architecture Firewall 89

Security Affairs

SEPTEMBER 1, 2021

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware , it appeared on the threat landscape in late 2019. According to the researchers, in the last months of 2019, the botnet was mainly involved in DDoS attacks. SecurityAffairs – hacking, Mozi botnet). Pierluigi Paganini.

IoT 78

IoT DNS Manufacturing Passwords 78

Security Affairs

OCTOBER 25, 2019

We're investigating reports of intermittent DNS resolution errors with Route 53 & our external DNS providers. — AWS Support (@AWSSupport) October 22, 2019. According to the company status page, hackers were targeting the AWS DNS servers flooding them with junk network traffic.

DDOS 51

DDOS DNS Advertising Engineering 51

Security Affairs

JULY 30, 2019

An attacker can intercept the TCP connection in different ways, for example using DNS changer malware, targeting DNS servers and carrying out Man-in-The-Middle attacks. “As each vulnerability affects a different part of the network stack, it impacts a different set of VxWorks versions.

Risk 73

Risk IoT Firewall DNS 73

Security Affairs

MARCH 22, 2020

The expert Bob Diachenko has discovered an unsecured Elasticsearch install belonging to a UK security firm that contained 5 billion records of data leaked in previous incidents that took place between 2012 and 2019. ” wrote Security Discovery’s researcher Bob Diachenko.

Data breaches 99

Data breaches DNS Advertising Engineering 99

Security Affairs

AUGUST 19, 2019

It allows users using web browsers to set up user accounts, Apache, DNS, file sharing and much more. News of the day is that Webmin contained a remote code execution vulnerability, tracked as CVE-2019-15107, for more than a year. I'ill share detailed information about my presentation and vulnerabilities very soon!

Passwords 80

Passwords System Administration Advertising DNS 80

Security Affairs

JULY 23, 2019

Attackers also noticed that systems infected with the above two families were also targeted with the RoyalDNS malware that uses DNS to communicate with the C&C server. Once executed the command the backdoor returns output through DNS. SecurityAffairs – APT15, hacking). “The Ke3chang APT group (a.k.a. .

DNS 87

DNS Malware Advertising Manufacturing 87

Security Affairs

JULY 15, 2020

Trustwave SpiderLabs has not yet been able to obtain a copy of this file and is requesting assistance from our readers to contact us at goldenspy@trustwave.com if they have information on this file or a sample for us to analyze.” ” Experts speculate GoldenHelper was active from January 2018 until July 2019.

Software 83

Software Malware Banking Advertising 83

Security Affairs

MARCH 4, 2020

The CAA security feature allows domain owners to prevent Certificate Authorities (CAs) to issue certificates for their domains. Domain owners can add a “CAA field” to their domain’s DNS records, this implies that only the CA included in this field can issue a TLS certificate for that domain. Pierluigi Paganini.

Encryption 110

Encryption Advertising DNS Software 110

Security Affairs

MARCH 22, 2020

The expert Bob Diachenko has discovered an unsecured Elasticsearch install belonging to the security firm Keepnet Labs that contained 5 billion records of data leaked in previous incidents that took place between 2012 and 2019. ” wrote Security Discovery’s researcher Bob Diachenko.

Data breaches 61

Data breaches DNS Advertising Engineering 61

Security Affairs

NOVEMBER 21, 2019

“Fast forwarded to October 11, 2019, our Anglerfish honeypot captured another suspicious ELF sample, and it turned out to be the Downloader of the previous suspicious ELF sample.” It allows users using web browsers to set up user accounts, Apache, DNS, file sharing and much more.

DDOS 81

DDOS System Administration Advertising DNS 81

Security Affairs

DECEMBER 18, 2019

The C&C servers were live as recently as November 18 2019.” ” Momentum supports 36 different methods for DDoS attacks, including multiple reflection and amplifications attack methods that target MEMCACHE , LDAP , DNS and Valve Source Engine. . “The distribution server (as seen above) hosts the malware executables.

Malware 63

Malware DDOS DNS Advertising 63