SecureList

APRIL 27, 2021

This is our latest installment, focusing on activities that we observed during Q1 2021. In parallel, Volexity also reported the same Exchange zero-days being in use in early 2021. The attackers used vulnerabilities in an SSL-VPN product to deploy a multi-layered loader we dubbed Ecipekac (aka DESLoader, SigLoader and HEAVYHAND).

Malware 145

Malware Government Spyware Social Engineering 145

Security Affairs

MARCH 16, 2021

“The attacks are still ongoing at the time of this writing.

Wireless 138

Wireless IoT DNS VPN 138

eSecurity Planet

AUGUST 13, 2021

If you’re shopping for an enterprise VPN , there’s a good chance NordVPN and ExpressVPN are on your list. Both vendors offer competitive VPN solutions that enable you and your employees to use the internet while maintaining privacy. Related: VPN Security Risks: Best Practices for 2021. Privacy and security.

VPN 109

VPN Encryption Internet Internet 109

Security Affairs

AUGUST 30, 2021

During an attack of this nature, it is difficult to find clear patterns without fast data and log processing and ad-hoc tools but our DNS servers were clearly recording these spikes of DNS updates every time the botnet was renewing IP addresses. Expert documentation from Luminati explaining the “resolve DNS at super proxy” feature.

DDOS 123

DDOS DNS Mobile Authentication 123

eSecurity Planet

JANUARY 14, 2022

Research by Cisco estimates the volume of DDoS attacks will surge from more than 10 million in 2021 up to 15 million by 2023. Meanwhile, the 2021 State of the Data Center Industry research report placed DDoS behind ransomware as the threats that most worry the enterprise. The most recent wave happened in December 2021.

DDOS 127

DDOS DNS Firewall Media 127

Security Affairs

AUGUST 29, 2023

Citrix reported that successful exploitation requires that the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. Then threat actors sent data as an image file to a web-accessible path: cp /var/tmp/test.tar.gz /netscaler/ns_gui/vpn/medialogininit.png. php) on victim machines.

VPN 125

VPN Ransomware DNS Malware 125

eSecurity Planet

MARCH 25, 2022

As remote desktop solutions are prevalent among IT and managed service providers (MSP), downstream clients can be at risk, as Kaseya experienced in 2021. In November 2021, an unauthorized third party called a Robinhood customer support employee and, through social engineering , gained access to the company’s customer support systems.

VPN 120

VPN Software Authentication Encryption 120

eSecurity Planet

MARCH 21, 2022

By using a misconfigured Cisco Duo MFA implementation to force enrollment of a new device, the hackers were then able to use the “PrintNightmare” Windows Print Spooler vulnerability ( CVE-2021-34527 and CVE-2021-36958 ) to obtain administrator privileges. Inactive Accounts and Default Configurations. Network Best Practices.

VPN 117

VPN Accountability Authentication Passwords 117

SecureList

JUNE 15, 2022

Request for access to corporate VPN. 2TB of 2020-2021 data: credentials related to banking accounts and the most popular services. I sell VPN accounts of USA companies, revenue is 1kkk$. Access type: VPN. Access type: VPN. Sale] VPN-RDP accounts for network access. Access type: VPN-RDP. Price: 7 000$.

VPN 128

VPN Accountability Ransomware Encryption 128

Vipre

JANUARY 25, 2021

Here are 5 common security tools that you must have in 2021 to protect your digital world. An easy way to enhance your online security and privacy is by using a VPN while browsing the internet. When using a VPN, the location of the server you are connected to is shown as your physical location. Identity Theft Protection Tools.

Identity Theft 40

Identity Theft Backups VPN Antivirus 40

eSecurity Planet

SEPTEMBER 29, 2021

Recent research by Positive Technologies looked at the cyber threat landscape during Q2 2021 and found that ransomware attacks reached “stratospheric” levels, accounting for 69% of all malware attacks, a huge jump from 39% in Q2 2020. Free VPN with up to 300 MB of traffic per day. DNS filtering.

Ransomware 109

Ransomware VPN Backups Malware 109

McAfee

SEPTEMBER 14, 2021

The PlugX families we observed used DNS [ T1071.001 ] [ T1071.004 ] as the transport channel for C2 traffic, in particular TXT queries. Another clue that helped us was the use of DNS tunneling by Winnti which we discovered traces of in memory. The hardcoded 208.67.222.222 resolves to a legitimate OpenDNS DNS server. 180.50.*.*.

Malware 144

Malware DNS Accountability Manufacturing 144

SecureList

OCTOBER 19, 2021

It retrieves the DNS names of all the directory trees in the local computer’s forest. This module uses an RAS (Remote Access Service) API to establish a VPN (Virtual Private Network) connection. The destination VPN server, and credentials for connection are provided by the C2’s command and configuration files.

Banking 145

Banking Passwords VPN Internet 145

SecureList

JUNE 3, 2024

Sample artifacts suggest that this version (V10, according to the attackers’ versioning system) may have started operating in 2022, although the first known Linux variant (V7), which has still not been publicly described, dates back to 2021. DinodasRAT is a multi-platform backdoor written in C++ that offers a range of capabilities.

Banking 117

Banking Malware Computers and Electronics Mobile 117

SecureList

JUNE 2, 2022

This can be done with the use of a VPN, but these may be illegal depending on the jurisdiction and would typically not be available to Chinese-speaking targets. A downloader utility and WinDealer of 2021 use the unique user-agent “BBB” The downloader periodically retrieves and runs an executable from hxxp://www.baidu[.]com/status/windowsupdatedmq.exe.

Malware 135

Malware Encryption Social Engineering Telecommunications 135

Cisco Security

AUGUST 28, 2023

XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. SCA detected 289 alerts including Suspected Port Abuse, Internal Port Scanner, New Unusual DNS Resolver,and Protocol Violation (Geographic).

Wireless 98

Wireless DNS Mobile Technology 98

SecureList

JULY 9, 2024

In 2021, MITRE completed its ATT&CK Data Sources project, its result being a methodology for describing a data object that can be used for detecting a specific technique. The expanded model includes several data components, which are parts of MITRE’s Network Traffic component, such as Web, Email, Internal DNS, and DHCP.

Engineering 115

Engineering DNS Technology Accountability 115

Kali Linux

NOVEMBER 27, 2022

As we mention in the Kali Raspberry Pi 4 documentation we use the nexmon firmware for the Raspberry Pi devices, so lets try searching for that instead: kali@kalipi:~$ dmesg | grep nexmon [ 5.070542] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Oct 3 2021 18:14:30 version 7.45.206 (nexmon.org: 2.2.2-343-ge3c8-dirty-5)

Firmware 52

Firmware Wireless Passwords VPN 52

SecureList

OCTOBER 26, 2021

This is our latest installment, focusing on activities that we observed during Q3 2021. This activity seems to have continued and stretched into 2021, when we spotted a set of recent attacks using the same techniques and malware to gain a foothold in diplomatic organizations based in Central Asia. The most remarkable findings.

Malware 145

Malware Government Surveillance Spyware 145

Security Boulevard

JANUARY 26, 2022

Note: This OSINT analysis has been originally published at my current employer's Web site - [link] where I'm currently acting as a DNS Threat Researcher since January, 2021. Original rogue portfolio of fake VPN service domains courtesy of the NSA: bluewebx[.]com. iranianvpn[.]net. DNSSPEEDY[.]TK. make-account[.]us. IRANTUNEL[.]COM.

VPN 98

VPN Internet Internet Cyber Attacks 98

McAfee

DECEMBER 1, 2021

CVE-2021-20322: Of all the words of mice and men, the saddest are, “it was DNS again.” PAN GlobalProtect VPN: CVE-2021-3064 . Palo Alto Networks (PAN) firewalls that use its GlobalProtect Portal VPN running PAN-OS versions older than 8.1.17 Linux Kernel: CVE-2021-20322 . Why am I here? .

DNS 90

DNS Firewall VPN Internet 90

SecureList

NOVEMBER 18, 2022

Number of new ransomware modifications, Q3 2021 — Q3 2022 ( download ). The attempts at exploiting network services and other software via vulnerabilities in the Log4j library ( CVE-2021-44228 , CVE-2021-44832 , CVE-2021-45046 , and CVE-2021-45105 ) also continued. Number of users attacked by ransomware Trojans.

Mobile 120

Mobile Malware Ransomware IoT 120

Duo's Security Blog

JANUARY 28, 2022

The requirements suggest taking an iterative approach: “Agencies must identify at least one internal-facing FISMA Moderate application and make it fully operational and accessible over the public internet” and “without relying on a virtual private network (VPN) or other network tunnel.”

Authentication 52

Authentication Government DNS Encryption 52

Security Affairs

MAY 16, 2021

Every week the best security articles from Security Affairs free for you in your email box.

Ransomware 104

Ransomware Banking DNS DDOS 104