Security Affairs

DECEMBER 29, 2023

On Christmas Eve, Resecurity’s HUNTER unit spotted the author of perspective password stealer Meduza has released a new version (2.2). Presently, Meduza password stealer supports Windows Server 2012/2016/2019/2022 and Windows 10/11.

Password Management 118

Password Management Cryptocurrency Passwords Authentication 118

Security Affairs

MAY 2, 2024

The threat actors were observed using methods such as exploiting virtual network computing (VNC) remote access software and default passwords. The malicious activity began in 2022 and is still ongoing. ” The pro-Russia hacktivists tend to over exaggerate their the effects of the attacks. ” concludes the advisory.

Passwords 85

Passwords Internet Internet Software 85

Security Affairs

JULY 9, 2022

Four of the fixed issues have been rated as a “high” severity, they are CVE-2022-26117, CVE-2021-43072, CVE-2022-30302, and CVE-2021-41031.

Authentication 136

Authentication Passwords Hacking Accountability 136

Security Affairs

SEPTEMBER 18, 2022

The Password management solution LastPass revealed that the threat actors had access to its systems for four days during the August hack. Password management solution LastPass shared more details about the security breach that the company suffered in August 2022. ” ?? . the developer?had ” states the notice.

Hacking 92

Hacking Password Management Passwords Authentication 92

Security Affairs

NOVEMBER 10, 2022

The vulnerability, CVE-2022-0902 (CVSS score: 8.1), is a path-traversal issue that can be exploited by an attacker to inject and execute arbitrary code. “Team82 found a high-severity path-traversal vulnerability (CVE-2022-0902) in ABB’s TotalFlow Flow Computers and Remote Controllers. ” concludes the advisory.

Firmware 125

Firmware Authentication Passwords Manufacturing 125

Security Affairs

NOVEMBER 3, 2022

One of the high-severity issues is a persistent XSS, tracked as CVE-2022-38374 , in Log pages of FortiADC. Another issue addressed by the company is a command injection in CLI command, tracked as CVE-2022-33870 , of FortiTester. The full list of vulnerabilities addressed in November 2022 is available here. Pierluigi Paganini.

Firewall 100

Firewall Authentication Passwords Hacking 100

Security Affairs

MAY 11, 2023

.” The vulnerabilities, tracked as CVE-2023-27357 , CVE-2023-27367 , CVE-2023-27368 , CVE-2023-27369 , CVE-2023-27370 , were demonstrated by Claroty researchers during the 2022 Pwn2Own Toronto hacking contest as part of an exploit. “NETGEAR is aware of multiple security vulnerabilities on the RAX30. We are in the final!

Hacking 92

Hacking Firmware Authentication DNS 92

Security Affairs

FEBRUARY 27, 2023

Password management software firm LastPass disclosed a “second attack,” a threat actor used data stolen from the August security breach and combined it with information available from a third-party data breach. The hackers installed a keylogger on the DevOp engineer’s computed and captured his master password.

Engineering 98

Engineering Backups Data breaches Passwords 98

Security Affairs

JULY 20, 2022

The flaws were discovered by BitSight researchers, they have been tracked as CVE-2022-2107; CVE-2022-2141; CVE-2022-2199; CVE-2022-34150; and CVE-2022-33944. CVE-2022-2141 (CVSS score: 9.8) – Improper authentication allows a user to send some SMS commands to the GPS tracker without a password.

Manufacturing 99

Manufacturing Passwords Mobile Authentication 99

Security Affairs

AUGUST 14, 2023

The researchers discovered that client-side authentication while fetching configuration files from the ZTP service is not implemented. The researchers also discovered multiple authentication issues in the cryptographic routines of AudioCodes VoIP desk phones.

Firmware 84

Firmware Authentication Passwords Hacking 84

SecureList

MAY 14, 2024

Incident response analyst report 2023 As an information security company, our services include incident response and investigation, and malware analysis. Our customer base spans Russia, Europe, Asia, South and North America, Africa and the Middle East. Ransomware targeted organizations indiscriminately, regardless of industry.

Ransomware 88

Ransomware Authentication Passwords Government 88

Security Affairs

OCTOBER 17, 2023

In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine, including AwfulShred , CaddyWiper , HermeticWiper , Industroyer2 , IsaacWiper , WhisperGate , Prestige , RansomBoggs , and ZeroWipe. The group is also the author of the NotPetya ransomware that hit hundreds of companies worldwide in June 2017. “Note (!)

Telecommunications 98

Telecommunications Authentication Data collection Passwords 98

Security Affairs

SEPTEMBER 2, 2023

The attacks targeted IT service desk staff to trick them into resetting all multi-factor authentication (MFA) factors enrolled by highly privileged users. The provider reported also that the threat actor removed the second factor for authentication policies. The company did not attribute the attack to a specific threat actor.

Social Engineering 126

Social Engineering Engineering Authentication Accountability 126

Security Affairs

AUGUST 5, 2022

RapperBot is a new botnet employed in attacks since mid-June 2022 that targets Linux SSH servers with brute-force attacks. Researchers from FortiGuard Labs have discovered a new IoT botnet tracked as RapperBot which is active since mid-June 2022. The bulk of the malware code contains an implementation of an SSH 2.0

IoT 133

IoT Malware Passwords Authentication 133

Security Affairs

AUGUST 13, 2023

The CVE-2022-47391 received a severity rating of 7.5, “The discovery of these vulnerabilities highlights the critical importance of ensuring the security of industrial control systems and underscores the need for continuous monitoring and protection of these environments.” ” reads the advisory published by Microsoft.

Authentication 84

Authentication Firmware Hacking Passwords 84

Security Affairs

NOVEMBER 2, 2022

The company pointed out that no one’s content, passwords, or payment information were accessed, it also remarked that the issue was quickly resolved. The investigation revealed that the code accessed by the attackers contained some credentials, primarily, API keys, used by the development team.

Phishing 116

Phishing Authentication Passwords Accountability 116

Security Affairs

DECEMBER 16, 2022

million records dated September 2022. “Looking to sell SocialBlade.com dumped September 2022. The exposed data include email addresses, password hashes, client IDs, IP addresses, and tokens for business API users, authentication tokens for connected accounts, and non-personal and internal data was compromised.

Data breaches 88

Data breaches Passwords Media Phishing 88

Security Affairs

JANUARY 13, 2024

We talked about NAS devices and ransomware in the weekly review 37/2022.” ” The ransomware attack reported in late 2023, targeted organizations’ networks using poorly secured VPN gateway on Cisco ASA or FTD devices. The Finish researchers pointed out that the attack cannot bypass multi-step authentication.

Ransomware 103

Ransomware Backups VPN Authentication 103

Security Affairs

JULY 29, 2022

The malicious code can detect when a user logs in, change email or password, enable/disable multi-factor authentication (MFA) and add new payment methods, including complete bank card details. 2022-07-17 20:28:29 small-sm 4.2.0 2022-07-17 19:47:56 small-sm 4.0.0 2022-07-17 19:43:57 small-sm 1.1.0

Malware 96

Malware Banking Authentication Passwords 96

Cisco Security

MAY 27, 2022

In part one of our Black Hat Asia 2022 NOC blog , we discussed building the network with Meraki: . NetWitness PCAP file carving and submission to Cisco Secure Malware Analytics (formerly Threat Grid) for analysis. New Integrations Created at Black Hat Asia 2022. Meraki MR, MS, MX and Systems Manager by Paul Fidler .

Malware 72

Malware Accountability DNS Technology 72

Security Affairs

JANUARY 12, 2023

million user accounts reported in November were the same exposed in August 2022. None of the datasets analyzed contained passwords or information that could lead to passwords being compromised. The company has found “no evidence” that the data were obtained by hacking into its systems. ” said Gal.

Data breaches 98

Data breaches Authentication Passwords Hacking 98

Security Affairs

APRIL 15, 2022

Cisco has released security patches to fix a critical vulnerability (CVSS score 10), tracked as CVE-2022-20695 , in Cisco Wireless LAN Controller (WLC). A remote, unauthenticated attacker could exploit the flaw to bypass authentication and log in to the device through the management interface. or Release 8.10.162.0

Wireless 83

Wireless Software Authentication Mobile 83

Security Affairs

MARCH 14, 2023

AiTM phishing allows threat actors to circumvent multifactor authentication (MFA) through reverse-proxy functionality. The proxy server allows attackers to access the traffic and capture the target’s password and the session cookie. As of this writing, the actor offers the tool for $300, with VIP licenses at $1,000.

Phishing 72

Phishing Cybercrime Authentication Mobile 72

Security Affairs

APRIL 23, 2024

The group gained access to the network of a defense industry company since November 2022. The hackers deployed a malware and took control of the company’s internal network and exfiltrared important data from, including information stored on the computers of employees in the development team. concludes the advisory.

Hacking 77

Hacking Malware Accountability Technology 77

Cisco Security

DECEMBER 22, 2022

2022 was Cisco’s sixth year as a NOC partner for Black Hat Europe. We used experiences of Black Hat Asia 2022 and Black Hat USA 2022 to refine the planning for network topology design and equipment. Below are our fellow NOC partners providing hardware, to build and secure the network, for our joint customer: Black Hat.

Engineering 62

Engineering Mobile Malware Wireless 62

Security Affairs

JULY 26, 2023

A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface.” The CVE-2023-30799 flaw can be exploited by a remote and an authenticated attacker to escalate privileges from admin to ‘super-admin’ which allows it to get a root shell on the router.

Hacking 91

Hacking Passwords Authentication Encryption 91

Security Affairs

JANUARY 20, 2023

The company is sending out breach notification letters to the impacted customers, threat actors had access to names, addresses, Social Security Numbers, individual tax identification numbers, dates of birth for PayPal users, and of course transaction histories. ” reads the letter sent by the company to the affected customers.

Data breaches 84

Data breaches Identity Theft Accountability Passwords 84

Security Affairs

MARCH 5, 2022

FckPutin #FreeUkraine pic.twitter.com/NJZiLx5c0d — Anonymous TV (@YourAnonTV) March 3, 2022. The leaked data includes information related to the company's source code, and WellPro projects. OpRussia #FCKPTN pic.twitter.com/KVJ5Je47Aj — Anonymous TV (@YourAnonTV) March 4, 2022. ” reported Avionews.

Hacking 143

Hacking Government Banking Media 143

Security Affairs

MAY 14, 2023

Researchers from FortiGuard Labs first discovered the previously undetected RapperBot IoT botnet in August, and reported that it is active since mid-June 2022. ssh/authorized_keys, anyone with the corresponding private key can authenticate the SSH server without supplying a password. ” We are in the final!

IoT 91

IoT Malware Passwords Authentication 91

Security Affairs

NOVEMBER 18, 2022

Atlassian announced the release of security updates to address critical-severity vulnerabilities in its identity management platform, Crowd Server and Data Center , and in the Bitbucket Server and Data Center , a self-managed solution that provides source code collaboration for professional teams. ” reads the advisory. .

Authentication 90

Authentication Passwords Hacking Information Security 90

Security Affairs

JUNE 8, 2022

“Upon gaining an initial foothold into a telecommunications organization or network service provider, PRC state-sponsored cyber actors have identified critical users and infrastructure including systems critical to maintaining the security of authentication, authorization, and accounting.

Telecommunications 92

Telecommunications Authentication Passwords Accountability 92

Security Affairs

JANUARY 13, 2024

We talked about NAS devices and ransomware in the weekly review 37/2022.” ” The ransomware attack reported in late 2023, targeted organizations’ networks using poorly secured VPN gateway on Cisco ASA or FTD devices. The Finish researchers pointed out that the attack cannot bypass multi-step authentication.

Ransomware 80

Ransomware Backups VPN Authentication 80

Security Affairs

SEPTEMBER 15, 2022

Below are some cases included in the alert: April 2022: Threat actors posing as an employee of a healthcare company with more than 175 medical providers changed Automated Clearing House (ACH) instructions of one of their payment processing vendors to redirect the payments. Require all accounts with password logins (e.g.,

Healthcare 74

Healthcare Social Engineering Accountability Passwords 74

Security Affairs

MARCH 16, 2022

pic.twitter.com/wOCdRqOJej — NEXTA (@nexta_tv) March 6, 2022. Spurred into action by the invasion of Ukraine, Spielerkid89 decided to investigate whether he could find Russian IPs with disabled authentication to fool with. Ideally, VNC should be used only with authenticated users, such as system administrators.

Authentication 126

Authentication Cyber Attacks System Administration Internet 126

Cisco Security

MAY 26, 2022

Not only that, because of the training events happening during the week, as well as TWO dedicated SSIDs for the Registration and lead tracking iOS devices (more of which later), one for initial provisioning (which was later turned off), and one for certificated based authentication, for a very secure connection. Network Visibility.

Wireless 81

Wireless Mobile Engineering Firewall 81

Security Affairs

JANUARY 24, 2023

GoTo is notifying customers that its development environment was breached in November 2022, attackers stole customers’ backups and encryption key. “Upon learning of the incident, we immediately launched an investigation, engaged Mandiant, a leading security firm, and alerted law enforcement. ” continues the notice.

Backups 86

Backups Encryption Data breaches Passwords 86

Security Affairs

NOVEMBER 3, 2023

In October, the Cloud identity and access management solutions provider said that threat actors broke into its support case management system and stole authentication data, including cookies and session tokens, that can be abused in future attacks to impersonate valid users. ” continues the post.

Data breaches 113

Data breaches Social Engineering Accountability Authentication 113