Security Affairs

AUGUST 29, 2023

Citrix reported that successful exploitation requires that the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. Sophos X-Ops is currently tracking a campaign by threat actors targeting unpatched Citrix NetScaler systems exposed to the internet. php) on victim machines.

VPN 103

VPN Ransomware DNS Malware 103

eSecurity Planet

MARCH 21, 2022

By using a misconfigured Cisco Duo MFA implementation to force enrollment of a new device, the hackers were then able to use the “PrintNightmare” Windows Print Spooler vulnerability ( CVE-2021-34527 and CVE-2021-36958 ) to obtain administrator privileges. Inactive Accounts and Default Configurations. Network Best Practices.

VPN 117

VPN Accountability Authentication Passwords 117

SecureList

JUNE 3, 2024

Sample artifacts suggest that this version (V10, according to the attackers’ versioning system) may have started operating in 2022, although the first known Linux variant (V7), which has still not been publicly described, dates back to 2021. It simulated the isolated system without access to the internet.

Banking 83

Banking Malware Computers and Electronics Mobile 83

McAfee

DECEMBER 1, 2021

CVE-2021-20322: Of all the words of mice and men, the saddest are, “it was DNS again.” PAN GlobalProtect VPN: CVE-2021-3064 . Palo Alto Networks (PAN) firewalls that use its GlobalProtect Portal VPN running PAN-OS versions older than 8.1.17 Linux Kernel: CVE-2021-20322 . Why am I here? .

DNS 90

DNS Firewall VPN Internet 90

SecureList

JUNE 2, 2022

This can be done with the use of a VPN, but these may be illegal depending on the jurisdiction and would typically not be available to Chinese-speaking targets. A downloader utility and WinDealer of 2021 use the unique user-agent “BBB” The downloader periodically retrieves and runs an executable from hxxp://www.baidu[.]com/status/windowsupdatedmq.exe.

Malware 125

Malware Encryption Social Engineering Telecommunications 125

Security Boulevard

JANUARY 26, 2022

Note: This OSINT analysis has been originally published at my current employer's Web site - [link] where I'm currently acting as a DNS Threat Researcher since January, 2021. Original rogue portfolio of fake VPN service domains courtesy of the NSA: bluewebx[.]com. iranianvpn[.]net. DNSSPEEDY[.]TK. make-account[.]us. IRANTUNEL[.]COM.

VPN 98

VPN Internet Internet Cyber Attacks 98

eSecurity Planet

MARCH 25, 2022

As remote desktop solutions are prevalent among IT and managed service providers (MSP), downstream clients can be at risk, as Kaseya experienced in 2021. Also read : Best Internet Security Suites & Software. Meanwhile, the suspect server was connected to the CDOT domain with an administrator account and the internet.

VPN 120

VPN Software Authentication Encryption 120

SecureList

APRIL 27, 2021

This is our latest installment, focusing on activities that we observed during Q1 2021. In parallel, Volexity also reported the same Exchange zero-days being in use in early 2021. The attackers used vulnerabilities in an SSL-VPN product to deploy a multi-layered loader we dubbed Ecipekac (aka DESLoader, SigLoader and HEAVYHAND).

Malware 143

Malware Spyware Government Social Engineering 143

Kali Linux

NOVEMBER 27, 2022

As we mention in the Kali Raspberry Pi 4 documentation we use the nexmon firmware for the Raspberry Pi devices, so lets try searching for that instead: kali@kalipi:~$ dmesg | grep nexmon [ 5.070542] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Oct 3 2021 18:14:30 version 7.45.206 (nexmon.org: 2.2.2-343-ge3c8-dirty-5)

Firmware 52

Firmware Wireless Passwords VPN 52

eSecurity Planet

JANUARY 14, 2022

Research by Cisco estimates the volume of DDoS attacks will surge from more than 10 million in 2021 up to 15 million by 2023. Meanwhile, the 2021 State of the Data Center Industry research report placed DDoS behind ransomware as the threats that most worry the enterprise. The most recent wave happened in December 2021.

DDOS 127

DDOS DNS Firewall Media 127

McAfee

SEPTEMBER 14, 2021

The PlugX families we observed used DNS [ T1071.001 ] [ T1071.004 ] as the transport channel for C2 traffic, in particular TXT queries. Another clue that helped us was the use of DNS tunneling by Winnti which we discovered traces of in memory. The hardcoded 208.67.222.222 resolves to a legitimate OpenDNS DNS server. 180.50.*.*.

Malware 144

Malware DNS Accountability Manufacturing 144

SecureList

JUNE 15, 2022

Request for access to corporate VPN. 2TB of 2020-2021 data: credentials related to banking accounts and the most popular services. I sell VPN accounts of USA companies, revenue is 1kkk$. Access type: VPN. Access type: VPN. Sale] VPN-RDP accounts for network access. Access type: VPN-RDP. Price: 7 000$.

VPN 104

VPN Accountability Ransomware Encryption 104

Duo's Security Blog

JANUARY 28, 2022

The requirements suggest taking an iterative approach: “Agencies must identify at least one internal-facing FISMA Moderate application and make it fully operational and accessible over the public internet” and “without relying on a virtual private network (VPN) or other network tunnel.”

Authentication 52

Authentication Government DNS Encryption 52

Cisco Security

AUGUST 28, 2023

XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. SCA detected 289 alerts including Suspected Port Abuse, Internal Port Scanner, New Unusual DNS Resolver,and Protocol Violation (Geographic).

Wireless 60

Wireless DNS Mobile Technology 60

SecureList

NOVEMBER 18, 2022

The former threatened files accessible from the internet over SMB protocol and protected by a weak account password. Threats that target NAS remain prominent, so we recommend keeping these devices inaccessible from the internet to ensure maximum safety of your data. Number of users attacked by ransomware Trojans.

Mobile 96

Mobile Malware Ransomware IoT 96

SecureList

OCTOBER 19, 2021

It targets the storage databases of Chrome, Firefox, Internet Explorer and Microsoft Edge. The browsers Internet Explorer, Mozilla Firefox, Google Chrome, and Microsoft Edge are targeted. It retrieves the DNS names of all the directory trees in the local computer’s forest. cookiesDll32. domainDll32. fscanDll32.

Banking 143

Banking Passwords VPN Internet 143

SecureList

OCTOBER 26, 2021

This is our latest installment, focusing on activities that we observed during Q3 2021. This activity seems to have continued and stretched into 2021, when we spotted a set of recent attacks using the same techniques and malware to gain a foothold in diplomatic organizations based in Central Asia. The most remarkable findings.

Malware 144

Malware Government Surveillance Spyware 144