Security Affairs

JUNE 17, 2021

Iran-linked Ferocious Kitten APT group used instant messaging apps and VPN software like Telegram and Psiphon to deliver Windows RAT and spy on targets’ devices. ” Kaspersky spotted the activity of the group by investigating two weaponized documents that were uploaded to VirusTotal in July 2020 and March 2021. .

VPN 124

VPN Internet Internet Software 124

Security Affairs

JANUARY 1, 2021

Impacted devices include Unified Security Gateway (USG), ATP, USG FLEX and VPN firewalls products. 2020 VPN series running firmware ZLD V4.60 Patch1 in April 2021 NXC5500 V6.10 Patch1 in April 2021. 2020 VPN series running firmware ZLD V4.60 Patch1 in April 2021 NXC5500 V6.10 Patch1 in April 2021.

Firewall 140

Firewall VPN Firmware Passwords 140

Krebs on Security

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. SocksEscort[.]com com , is what’s known as a “SOCKS Proxy” service. SocksEscort began in 2009 as “ super-socks[.]com

Malware 203

Malware VPN Internet Internet 203

Security Affairs

SEPTEMBER 22, 2021

CVE-2021-40847 flaw in Netgear SOHO routers could be exploited by a remote attacker to execute arbitrary code as root. Security experts from consulting firm GRIMM have discovered a vulnerability in Small Offices/Home Offices (SOHO) Netgear routers that could be exploited by a remote attacker to execute arbitrary code as root.

DNS 129

DNS Firmware VPN Risk 129

Security Affairs

JULY 3, 2023

Researchers reported that there are 490,000 Fortinet firewalls exposing SSL VPN interfaces on the internet, and roughly 69% of them are still vulnerable to CVE-2023-27997. For this reason, if the customer has SSL-VPN enabled, Fortinet is advising customers to take immediate action to upgrade to the most recent firmware release.

Firewall 83

Firewall VPN Firmware Internet 83

Security Affairs

SEPTEMBER 8, 2021

Russian communications watchdog Roskomnadzor tightens control of its citizens and blocked access to six virtual private networks (VPNs), including NordVPN and ExpressVPN. Russian communications watchdog Roskomnadzor tightens the control over the Internet and blocked access to six virtual private networks (VPNs), Hola!VPN,

VPN 75

VPN Internet Internet Mobile 75

Security Affairs

AUGUST 29, 2021

Taiwan vendor Synology announced that recently disclosed vulnerabilities (CVE-2021-3711 and CVE-2021-3712) in the OpenSSL impact some of its products. Moderate Ongoing VPN Plus Server Important Ongoing VPN Server Moderate Ongoing. Moderate Ongoing VPN Plus Server Important Ongoing VPN Server Moderate Ongoing.

VPN 121

VPN Encryption Authentication Hacking 121

Security Affairs

JULY 13, 2021

NetBlocks reported partial disruption to social media and messaging platforms in Cuba from 12 July 2021 shortly after Cubans went to the streets to protest the government. VPN services have yet to be blocked in the country, allowing citizens to bypass internet censorship. Source Fox News. .”

Media 93

Media Government Internet Internet 93

Security Affairs

JANUARY 25, 2022

PrinterLogic has released security updates to address nine vulnerabilities in Web Stack and Virtual Appliance, the most severe ones, tracked as CVE-2021-42631, CVE-2021-42635, and CVE-2021-42638, are rated as high severity flaws (CVSS base score of 8.1). The flaws impact all PrinterLogic Web Stack version 19.1.1.13

VPN 84

VPN Internet Internet Software 84

Security Affairs

AUGUST 3, 2023

” Government experts warn that in 2022, most of the exploited flaws were older software vulnerabilities and that threat actors targeted unpatched, internet-facing systems. The vulnerability was exploited by multiple threat actors [ 1 , 2 , 3 , 4 , 5 ], including Russia-linked APT groups that targeted critical infrastructure.

Authentication 82

Authentication VPN Internet Internet 82

Security Affairs

JUNE 23, 2021

A critical vulnerability, tracked as CVE-2021-20019 , in SonicWall VPN appliances was only partially patched last year and could allow a remote attacker to steal sensitive data. The flaw resides in the HTTP/HTTPS service used for product management as well as SSL VPN remote access. “An reads the analysis published by Tripwire.

VPN 86

VPN Firewall Firmware Authentication 86

ForAllSecure

MAY 25, 2021

Black Hat Briefings USA ( Jul 31, 2021 through Thu, Aug 5, 2021). BsidesLV (July 31 and August 1, 2021). BSidesLV will be entirely virtual in 2021. For example, FuzzCON 2021 will be hybrid, in person and virtual, the Thursday night between Black Hat and DEF CON. It’s an extra layer of security.

VPN 52

VPN Passwords Internet Internet 52

ForAllSecure

MAY 25, 2021

Black Hat Briefings USA ( Jul 31, 2021 through Thu, Aug 5, 2021). BsidesLV (July 31 and August 1, 2021). BSidesLV will be entirely virtual in 2021. For example, FuzzCON 2021 will be hybrid, in person and virtual, the Thursday night between Black Hat and DEF CON. It’s an extra layer of security.

VPN 52

VPN Passwords Internet Internet 52

Security Affairs

SEPTEMBER 1, 2021

We will release security updates and provide further information as soon as possible.” ” The two vulnerabilities are CVE-2021-3711 and CVE-2021-3712 , they are respectively a remote code execution (RCE) and denial-of-service (DoS). credentials) in the heap while the issue is exploited.

VPN 85

VPN Encryption Hacking Internet 85

Security Affairs

MAY 27, 2022

In May 2021, cybercriminals offered more than 36,000 login credentials for.edu email accounts and advertised the data on an instant messaging platform. In May 2021, over 36,000 email and password combinations for.edu email accounts were offered for sale on a publically available instant messaging platform.

Cybercrime 131

Cybercrime Education Accountability Phishing 131

Security Affairs

DECEMBER 22, 2022

Microsoft Threat Intelligence Center (MSTIC) researchers discovered a new variant of the Zerobot botnet (aka ZeroStresser) that was improved with the capabilities to target more Internet of Things (IoT) devices. The IT giant is tracking this cluster of threat activity as DEV-1061. “Since the release of Zerobot 1.1,

IoT 116

IoT DDOS Malware Firmware 116

Krebs on Security

MAY 22, 2023

Chaput said the spammers used more than 1,500 Internet addresses across 400 providers to register new accounts, which then followed popular accounts on Mastodon and sent private mentions to the followers of those accounts. that were created from different Internet addresses in Vienna, Austria. billion last year.

Scams 243

Scams DDOS Cryptocurrency Accountability 243

Security Affairs

AUGUST 29, 2023

Citrix reported that successful exploitation requires that the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. Sophos X-Ops is currently tracking a campaign by threat actors targeting unpatched Citrix NetScaler systems exposed to the internet. php) on victim machines.

VPN 104

VPN Ransomware DNS Malware 104

Security Affairs

AUGUST 17, 2021

If the management interface is exposed to the internet, an attacker could trigger the issue to reach into the affected network beyond the DMZ. Such kinds of devices should only be reachable only via trusted, internal networks or a secure VPN connection. is expected to include a fix, and will be released at the end of August.

Authentication 98

Authentication VPN Internet Internet 98

Security Affairs

FEBRUARY 26, 2022

Unit 42 attributes the malware to an APT campaign codenamed TiltedTemple (aka DEV-0322 ), threat actors also exploited the Zoho ManageEngine ADSelfService Plus vulnerability ( CVE-2021-40539 ) and ServiceDesk Plus vulnerability ( CVE-2021-44077 ). based defense contractor’s internet-facing Windows server on July 27, 2021.

Backups 91

Backups VPN Healthcare Malware 91

Security Affairs

NOVEMBER 26, 2021

Resecurity, a Los Angeles-based cybersecurity company has identified an active a zero-day vulnerability in the TP-Link device with model number TL-XVR1800L (Enterprise AX1800 Dual Band Gigabit Wi-Fi 6 Wireless VPN Router), which is primarily suited to enterprises.

IoT 141

IoT Wireless DDOS VPN 141

Security Affairs

JULY 14, 2023

The malware was spotted the first time in May 2021, but has been operating under the radar for more than two years. “Based on information associated with their x.509 509 certificates, we assess that some of these second stage C2s have been active since at least October 2021. ” continues the report.

Malware 81

Malware Advertising Cybercrime Passwords 81

Security Affairs

JUNE 30, 2022

Good news for the victims of the Hive ransomware, Korean security researchers have released a free decryptor for some versions. “The Korea Internet & Security Agency (KISA) is distributing the Hive ransomware integrated recovery tool.This recovery tool can recover Hive ransomware version 1 to version 4.”

Ransomware 108

Ransomware Cybersecurity Encryption VPN 108

Security Affairs

DECEMBER 13, 2023

The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

Small Business 112

Small Business Technology VPN Manufacturing 112

CyberSecurity Insiders

DECEMBER 24, 2021

As long-time information security professionals and (ISC)² Community Champions, we have experienced the way cybersecurity employees engage and work with one another continue to adapt in response to changes in the workplace and world at large. In 2021, we experienced a rapid evolution to these interactions. Privacy laws.

Cybersecurity 98

Cybersecurity Ransomware VPN Architecture 98

Security Affairs

SEPTEMBER 3, 2021

. “Cyber criminal threat actors exploit network vulnerabilities to exfiltrate data and encrypt systems in a sector that is increasingly reliant on smart technologies, industrial control systems, and internet-based automation systems. Only use secure networks and avoid using public Wi-Fi networks.

Ransomware 97

Ransomware Passwords Backups Firmware 97

Security Affairs

MAY 25, 2023

The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure. In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors.

Accountability 75

Accountability VPN Manufacturing Firewall 75

Security Affairs

JULY 31, 2023

The AVRecon botnet relies on compromised small office/home office (SOHO) routers since at least May 2021. Based on information associated with their x.509 509 certificates, we assess that some of these second stage C2s have been active since at least October 2021. continues the report. “We “ SocksEscort[.]com

Malware 91

Malware Small Business Advertising Passwords 91

Security Affairs

APRIL 11, 2021

prize pool Zerodium will pay $300K for WordPress RCE exploits Crooks abuse website contact forms to deliver IcedID malware Hackers compromised APKPure client to distribute infected Apps This man was planning to kill 70% of Internet in a bomb attack against AWS.

Cyber Attacks 53

Cyber Attacks Firmware Malware VPN 53

Security Affairs

MARCH 16, 2022

The nation-state actors gained access to the network by exploiting default MFA protocols and the Windows Print Spooler vulnerability, “PrintNightmare” ( CVE-2021-34527 ), reads the advisory. ” continues the analysis. Update software, including operating systems, applications, and firmware on IT network assets in a timely manner.

Accountability 92

Accountability Passwords Authentication Firmware 92

Security Affairs

MARCH 23, 2021

GE provides additional mitigations and information about these vulnerabilities in GE Publication Number: GES-2021-004 (login required).” The most severe issue addressed by the vendor is a critical “ INSECURE DEFAULT VARIABLE INITIALIZATION ” issue tracked as CVE-2021-27426 and rated with a CVSS score of 9.8

Firmware 78

Firmware VPN Firewall Risk 78

Security Affairs

JULY 8, 2021

The experts reported the flaw to the software vendor in February 2021 and the company addressed them with the release of Sage X3 Version 9 (Syracuse 9.22.7.2), Sage X3 HR & Payroll Version 9 (Syracuse 9.24.1.3), Sage X3 Version 11 (Syracuse 11.25.2.6), and Sage X3 Version 12 (Syracuse 12.10.2.8). ” continues the report.

Hacking 107

Hacking Authentication VPN Software 107

Security Affairs

JANUARY 6, 2021

Impacted devices include Unified Security Gateway (USG), ATP, USG FLEX and VPN firewalls products. hat tip @nathanqthai & @ackmage [link] pic.twitter.com/p8zIubXdzL — GreyNoise (@GreyNoiseIO) January 4, 2021. The vulnerability was discovered by the security researcher Niels Teusink from EYE.

Firmware 111

Firmware Passwords Accountability VPN 111

Security Affairs

MARCH 10, 2022

The variant employed in the attack against the IT Army is able to steal a broad range of data, including web browser data, VPN tools, Discord, Steam, and cryptocurrency wallets. Talos experts believe this is an opportunistic campaign, the same IP address is has been distributing Phoenix since November 2021. 35) on port 6666.

DDOS 84

DDOS Digital transformation Malware Advertising 84

Security Affairs

JUNE 8, 2022

Enforce MFA on all VPN connections [ D3-MFA ]. Isolate Internet-facing services in a network Demilitarized Zone (DMZ) to reduce the exposure of the internal network [ D3-NI ]. Enable robust logging of Internet-facing services and monitor the logs for signs of compromise [ D3-NTA ] [ D3-PM ].

Telecommunications 95

Telecommunications Authentication Passwords Accountability 95

Security Affairs

APRIL 2, 2021

In March 2021, government experts observed state sponsored hackers scanning the internet for servers vulnerable to the above flaws, the attackers were probing systems on ports 4443, 8443, and 10443. Provide users with training on information security principles and techniques, particularly on recognizing and avoiding phishing emails.

Passwords 66

Passwords Government Firmware Accountability 66

Security Affairs

OCTOBER 12, 2020

US government networks are under attack, threat actors chained VPN and Windows Zerologon flaws to gain unauthorized access to elections support systems. The post APT groups chain VPN and Windows Zerologon bugs to attack US government networks appeared first on Security Affairs. ” concludes the alert. Pierluigi Paganini.

VPN 139

VPN Government Authentication Advertising 139