Fox IT

JANUARY 12, 2021

NCC Group and Fox-IT observed this threat actor during various incident response engagements performed between October 2019 until April 2020. After obtaining a valid account, they use this account to access the victim’s VPN, Citrix or another remote service that allows access to the network of the victim.

VPN 68

VPN Accountability Passwords DNS 68

eSecurity Planet

MARCH 25, 2022

Like in the case of SolarWinds in 2020, masked threat actors aren’t afraid to linger for months during reconnaissance. By exploiting weak server vulnerabilities, the Iran-based hackers were able to gain access, move laterally, encrypt IT systems, and demand ransom payment. Extended Stays and Attack Execution.

VPN 111

VPN Software Authentication Encryption 111

Malwarebytes

MAY 12, 2021

Receivers are not required to check whether every fragment that belongs to the same frame is encrypted with the same key and will reassemble fragments that were decrypted using different keys. The design flaws were assigned the following CVEs: CVE-2020-24588 : Aggregation attack (accepting non-SPP A-MSDU frames). Vulnerable devices.

Encryption 90

Encryption Firewall Authentication DNS 90

eSecurity Planet

MAY 28, 2021

Ransomware: Encryption, Exfiltration, and Extortion. Ransomware perpetrators of the past presented a problem of availability through encryption. Detect Focus on encryption Assume exfiltration. Whether it’s a VPN , firewall , or remote access server, unauthorized entry via network gateways is a problem.

Software 99

Software Firmware DNS VPN 99

eSecurity Planet

SEPTEMBER 29, 2021

Recent research by Positive Technologies looked at the cyber threat landscape during Q2 2021 and found that ransomware attacks reached “stratospheric” levels, accounting for 69% of all malware attacks, a huge jump from 39% in Q2 2020. Free VPN with up to 300 MB of traffic per day. DNS filtering. Dark web monitoring.

Ransomware 102

Ransomware VPN Backups Malware 102

McAfee

SEPTEMBER 14, 2021

Inspecting the File (COFF) header, we observed the file’s compilation timestamp: TimeDateStamp: 05/12/2020 08:23:47 – Date and time the image was created. The PlugX families we observed used DNS [ T1071.001 ] [ T1071.004 ] as the transport channel for C2 traffic, in particular TXT queries. GET / */[redacted].rar. 180.50.*.*.

Malware 144

Malware DNS Accountability Manufacturing 144

SecureList

JUNE 15, 2022

Complex attacks almost invariably feature several phases, such as reconnaissance, initial access to the infrastructure, gaining access to target systems and/or privileges, and the actual malicious acts (data theft, destruction or encryption, etc.). Request for access to corporate VPN. Access type: VPN. Access type: VPN.

VPN 89

VPN Accountability Ransomware Encryption 89

SecureList

APRIL 27, 2021

One of the suspected FinFly Web servers was active for more than a year between October 2019 and December 2020. As it turned out, it was active for a very short time around September 2020 on a host that appears to have been impersonating the popular Mail.ru The activities peaked in November 2020, but are still ongoing.

Malware 138

Malware Spyware Government Social Engineering 138

SecureList

OCTOBER 19, 2021

Downloaded modules are encrypted, and can be decrypted with the Python script below. EMBEDDED MODULE PE timestamp:2020-09-17 InternalName:<payload32.dll> It retrieves the DNS names of all the directory trees in the local computer’s forest. This module contains the encrypted embedded module RwDrv.sys.

Banking 136

Banking Passwords VPN Internet 136

eSecurity Planet

MAY 2, 2024

50,000 DDoS attacks on public domain name service (DNS) resolvers. 553% increase in DNS Flood attacks from 1H 2020 to 2H 2023. DDoS attacks on single networks or websites render them unavailable, but DDoS attacks on DNS resolvers bring down all networks and websites using that DNS resource.

Cybersecurity 94

Cybersecurity DDOS Penetration Testing Passwords 94

eSecurity Planet

MAY 19, 2022

Already a leading SD-WAN pick, the HPE subsidiary boosted its market position with acquisitions of security vendor Cape Networks in 2018 and WAN specialist Silver Peak Systems in 2020. EdgeConnect Enterprise critically comes with firewall , segmentation , and application control capabilities. Features: Aruba EdgeConnect Enterprise SD-WAN.

Firewall 111

Firewall Architecture Encryption Network Security 111