Security Affairs

OCTOBER 6, 2019

The UK’s National Cyber Security Centre (NCSC) warns of attacks exploiting recently disclosed VPN vulnerabilities in Fortinet, Palo Alto Networks and Pulse Secure. Threat actors leverage VPN vulnerabilities in Fortinet, Palo Alto Networks and Pulse Secure, to breach into the target networks. Pierluigi Paganini.

VPN 88

VPN Advertising Healthcare Data breaches 88

Security Affairs

JANUARY 18, 2022

Europol this week announced the shutdown of VPNLab, a VPN service that is very popular in the cybercrime ecosystem. An international operation conducted by law enforcement bodies from 10 countries took down VPNLab.net, a VPN service provider that is very popular in the cybercrime ecosystem. Europol said. Pierluigi Paganini.

VPN 85

VPN Cybercrime Ransomware Advertising 85

Security Affairs

MAY 3, 2021

Pulse Secure has fixed a zero-day flaw in the Pulse Connect Secure (PCS) SSL VPN appliance that threat actors are actively exploiting in the wild. The vulnerability is a buffer overflow issue in Pulse Connect Secure Collaboration Suite prior b9.1R11.4 A vulnerability was discovered under Pulse Connect Secure (PCS).

VPN 109

VPN Government Authentication Cybersecurity 109

Security Affairs

JANUARY 17, 2020

Chinese authorities continue operations against unauthorized VPN services that are very popular in the country. China continues to intensify the monitoring of the cyberspace applying and persecution of VPN services that could be used to bypass its censorship system known as the Great Firewall. Pierluigi Paganini.

VPN 66

VPN Firewall Advertising Media 66

Security Affairs

FEBRUARY 20, 2020

More than 400 flaws affecting industrial control systems (ICS) were disclosed in 2019, more than 100 were zero-day vulnerabilities. According to a report published by Dragos, the experts analyzed 438 ICS vulnerabilities that were reported in 212 security advisories, 26% of advisories is related to zero-day flaws. Pierluigi Paganini.

Advertising 108

Advertising VPN Engineering Hacking 108

Security Affairs

SEPTEMBER 23, 2019

Security researcher Peleg Hadar of SafeBreach Labs discovered a privilege escalation flaw that impacts all versions of Forcepoint VPN Client for Windows except the latest release. “There is an unquoted search path vulnerability in Forcepoint VPN Client for Windows versions lower than 6.6.1.” Pierluigi Paganini.

VPN 64

VPN Advertising Hacking Malware 64

Krebs on Security

NOVEMBER 2, 2021

.” In the first week of September, Groove posted on its darknet blog nearly 500,000 login credentials for customers of Fortinet VPN products, usernames and passwords that could be used to remotely connect to vulnerable systems. Triggering the directors of information security companies. ” Image: @nokae8.

Ransomware 261

Ransomware Cybercrime VPN Media 261

Security Affairs

SEPTEMBER 19, 2021

The popular whistleblower Edward Snowden recommends customers of ExpressVPN VPN service to stop using it. Edward Snowden expressed concerns about the VPN service offered by ExpressVPN and has warned users to stop using it. If you're an ExpressVPN customer, you shouldn't be. Why Snowden is worried about ExpressVPN?

Surveillance 143

Surveillance VPN Hacking Cybersecurity 143

Security Affairs

APRIL 24, 2020

Experts from BadPackets pointed out that attackers might have exploited the Pulse Secure VPN CVE-2019-11510 to compromise the company. BadPackets reported that SeaChange had a Pulse Secure VPN server ( [link] ) vulnerable to CVE-2019-11510 from April 24, 2019 until March 24, 2020.

Software 103

Software Ransomware VPN Advertising 103

Security Affairs

MAY 17, 2020

Experts from security firm Bad Packets reported that Elexon had been running an outdated version of Pulse Secure VPN server, if confirmed threat actors could have exploited it to access the internal network. NSA also warned of multiple state-sponsored cyberespionage groups exploiting enterprise VPN Flaws.

Cyber Attacks 78

Cyber Attacks VPN Advertising Cyber threats 78

Security Affairs

APRIL 28, 2022

“Globally, in 2021, malicious cyber actors targeted internet-facing systems, such as email servers and virtual private network (VPN) servers, with exploits of newly disclosed vulnerabilities. This advisory also includes other frequently exploited vulnerabilities. ” reads the advisory published by CISA.

Software 145

Software VPN Cybersecurity Internet 145

Security Affairs

SEPTEMBER 1, 2020

The Iranian hacker group has been attacking corporate VPNs over the past months, they have been hacking VPN servers to plant backdoors in companies around the world targeting Pulse Secure , Fortinet , Palo Alto Networks , and Citrix VPNs. ” reads the report published by Crowdstrike.

Hacking 92

Hacking VPN Advertising Financial Services 92

Security Affairs

SEPTEMBER 2, 2022

The UNC2165 group has been active since at least 2019, it was mainly observed using the FAKEUPDATES infection chain (aka UNC1543 ) to access the victims’ networks. According to eSentire, the crooks gained access to the workforce management corporation’s IT network using stolen Virtual Private Network (VPN) credentials.

Hacking 99

Hacking VPN Ransomware Authentication 99

Security Affairs

JULY 28, 2021

The cybersecurity agencies warn of attacks aimed at exploiting flaws in VPN appliances, network equipment and enterprise cloud applications from multiple vendors, including Atlassian, Citrix. “Four of the most targeted vulnerabilities in 2020 affected remote work, VPNs, or cloud-based technologies. ” reads the joint report.

VPN 133

VPN Cybersecurity Hacking Technology 133

Security Affairs

SEPTEMBER 15, 2020

7 ] CVE-2019-19781 : Citrix Virtual Private Network (VPN) Appliances – CISA has observed the threat actors attempting to discover vulnerable Citrix VPN Appliances. CVE-2019-19781 enabled the actors to execute directory traversal attacks.[ CVE-2019-19781 enabled the actors to execute directory traversal attacks.[

Government 75

Government VPN Firmware Energy and Utilities 75

Security Affairs

NOVEMBER 11, 2021

Attackers also use to exploit the Kentico Content Management System (CVE-2019-10068) and used SQLmap to bypass Web Application Firewalls. . The threat actors also heavily leverage VPNs services such as Private Internet Access, Atlas VPN, TiKNet VPN, VPN Master Lite, and CyberGhost.

VPN 93

VPN Cybercrime Passwords Firewall 93

Security Affairs

JUNE 8, 2022

Enforce MFA on all VPN connections [ D3-MFA ]. Chinese hackers employed open-source tools for reconnaissance and vulnerability scanning, according to the government experts, they have utilized open-source router specific software frameworks, RouterSploit and RouterScan [ T1595.002 ], to identify vulnerable devices to target.

Telecommunications 97

Telecommunications Authentication Passwords Accountability 97

Security Affairs

MARCH 28, 2020

Since December 2019, researchers from Qihoo 360 observed two different attack groups that are employing two zero-days exploits to take over DrayTek enterprise routers to eavesdrop on FTP and email traffic inside corporate networks. The attacker is snooping on port 21,25,143,110 (1/2) — 360 Netlab (@360Netlab) December 25, 2019. #0-day

Firmware 83

Firmware VPN Accountability Advertising 83

Security Affairs

SEPTEMBER 10, 2020

.” The company did not disclose details of the attack, at the time the experts from BadPackets pointed out that attackers might have exploited the Pulse Secure VPN CVE-2019-11510 to compromise the company. and Elexon electrical middleman. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Ransomware 66

Ransomware VPN Banking Data breaches 66

Security Affairs

JULY 7, 2021

WildPressure APT is targeting industrial organizations in the Middle East since 2019 and was spotted using now a new malware that targets both Windows and macOS. Further investigation led to the discovery of other samples of the same malware that infected systems back in May, 2019.

Malware 125

Malware VPN Architecture Hacking 125

Security Affairs

JULY 22, 2019

The vulnerability, tracked as CVE-2019-1579, affects the GlobalProtect portal and GlobalProtect Gateway interface products. GlobalProtect products allow organizations to set up a virtual private network (VPN) access, they also implement other security and management features. Earlier versions are impacted.

VPN 66

VPN Advertising Authentication Information Security 66

Security Affairs

MARCH 16, 2022

The new vulnerabilities added to the catalog include one SonicWall SonicOS issue, tracked as CVE-2020-5135 , and 14 Microsoft Windows flaws addressed between 2016 and 2019. The CVE-2020-5135 is a stack-based buffer overflow that affects the SonicWall Network Security Appliance (NSA).

VPN 92

VPN Network Security Hacking Cybersecurity 92

Security Affairs

FEBRUARY 2, 2020

The p opular ProtonMail end-to-end encrypted email service and ProtonVPN VPN service have been blocked by the Russian government this week. This week the Russian government has blocked the ProtonMail end-to-end encrypted email service and ProtonVPN VPN service.

Government 95

Government VPN Telecommunications Advertising 95

Security Affairs

MARCH 20, 2020

In May 2019, the experts noticed that the group started using hacked email addresses of numerous high-profile targets to send credential spam messages. The group was observed using this scheme between 2019 and 2020, and according to the experts, most of the compromised email accounts belong to defense companies in the Middle East.

Phishing 138

Phishing Accountability Advertising DNS 138

Security Affairs

SEPTEMBER 25, 2020

The threat actors initially leveraged compromised credentials for Microsoft Office 365 (O365) accounts, domain administrator accounts, and credentials for the agency’s Pulse Secure VPN server. 166 and then browsed pages on a SharePoint site and downloaded a file (Data from Information Repositories: SharePoint [ T1213.002 ]).

VPN 96

VPN Malware Cyber threats Accountability 96

Security Affairs

AUGUST 4, 2020

The malware has been active at least since August 2019, over the months the NetWalker ransomware was made available through a ransomware-as-a-service (RaaS) model attracting criminal affiliates. “Since 2019, NetWalker ransomware has reached a vast number of different targets, mostly based in western European countries and the US.

Ransomware 75

Ransomware VPN Cybercrime Advertising 75

Security Affairs

FEBRUARY 26, 2022

According to the experts, the SockDetour backdoor has been in the wild since at least July 2019. According to Microsoft DEV-0322 is an APT group based in China, which employed commercial VPN solutions and compromised consumer routers in their attacker infrastructure. based defense contractors. ” concludes the report.

Backups 93

Backups VPN Healthcare Malware 93

Security Affairs

JANUARY 19, 2020

Security experts are monitoring a spike in the number of attacks against Citrix servers after that researchers announced the availability online of proof-of-concept exploits for the CVE-2019-19781 flaw in Citrix NetScaler ADC and Citrix NetScaler Gateway servers. vpns/portal/scripts/newbm.pl ” concludes FireEye.”NOTROBIN

Malware 90

Malware Advertising VPN Internet 90

Security Affairs

OCTOBER 10, 2019

MR-5 and earlier was recently discovered and responsibly disclosed to Sophos by an external security researcher.” “The vulnerability can be potentially exploited by sending a malicious request to either the Web Admin or SSL VPN consoles, which would enable an unauthenticated remote attacker to execute arbitrary commands.”

Firewall 82

Firewall VPN Passwords Internet 82

Security Affairs

JUNE 4, 2021

The vendor also released a tool that can scan Pulse Secure VPN servers for signs of compromise for CVE-2021-22893 or other previous vulnerabilities. In all the intrusions, the attackers targeted Pulse Secure VPN appliances in the breached networks. “In reads the report published by FireEye.

VPN 78

VPN Government Hacking Authentication 78

Security Affairs

APRIL 2, 2021

The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS: CVE-2018-13379 ; CVE-2020-12812 ; CVE-2019-5591. The joint alert also states that attackers scanning also enumerated devices for the CVE-2020-12812 and CVE-2019-5591 flaws. Disable hyperlinks in received emails.

Passwords 67

Passwords Government Firmware Accountability 67

Security Affairs

JUNE 23, 2020

According to Cyberintelligence firm Bad Packets , hackers allegedly exploited the CVE-2019-19781 vulnerability in the Citrix Netscaler ADC VPN gateway exposed by Indiabulls. The CVE-2019-19781 vulnerability affects Citrix Application Delivery Controller (ADC), Citrix Gateway, and Citrix SD-WAN WANOP appliances.

Hacking 102

Hacking Ransomware Banking Mobile 102

Security Affairs

NOVEMBER 26, 2021

Resecurity, a Los Angeles-based cybersecurity company has identified an active a zero-day vulnerability in the TP-Link device with model number TL-XVR1800L (Enterprise AX1800 Dual Band Gigabit Wi-Fi 6 Wireless VPN Router), which is primarily suited to enterprises.

IoT 142

IoT Wireless DDOS VPN 142

Security Affairs

JULY 15, 2021

Continued use of this firmware or end-of-life devices is an active security risk,” states the alert. 34 or 9.0.0.10 immediately Reset passwords Enable MFA.

Firmware 109

Firmware Ransomware Passwords Mobile 109

Security Affairs

JULY 18, 2021

Bleeping computer also added that CrowdStrike confirmed that several three actors, including HelloKitty ransomware operators, are attempting to exploit a flaw tracked as CVE-2019-7481. Follow me on Twitter: @securityaffairs and Facebook.

Ransomware 118

Ransomware Firmware Mobile InfoSec 118

Security Affairs

MAY 8, 2020

As a result, all RUB members, for example, have no access to the Outlook mail program and the VPN tunnel, which is necessary to access folders from the home office. e-mail, VPN tunnel, “Serviceportal”). ^sk Please vote Security Affairs for European Cybersecurity Blogger Awards – VOTE FOR YOUR WINNERS [link].

Cyber Attacks 99

Cyber Attacks VPN Advertising Hacking 99

Security Affairs

OCTOBER 13, 2019

UK NCSC agency warns of APTs exploiting Enterprise VPN vulnerabilities. MS October 2019 Patch Tuesday updates address 59 flaws. Users reported problems with patches for CVE-2019-1367 IE zero-day. Multiple APT groups are exploiting VPN vulnerabilities, NSA warns. SAP October 2019 Security Patch Day fixes 2 critical flaws.

VPN 53

VPN Spyware Data breaches Advertising 53