Security Affairs

SEPTEMBER 19, 2022

The FunJSQ module is used in various Netgear routers and Orbi WiFi systems, the issues affecting it were discovered in May 2022 and are now fixed. “Back in May 2022, we discovered FunJSQ , a third-party gaming speed-improvement service by China-based Xiamen Xunwang Network Technology Co.,

Firmware 95

Firmware Passwords Technology Hacking 95

Security Affairs

NOVEMBER 10, 2022

The vulnerability, CVE-2022-0902 (CVSS score: 8.1), is a path-traversal issue that can be exploited by an attacker to inject and execute arbitrary code. “Team82 found a high-severity path-traversal vulnerability (CVE-2022-0902) in ABB’s TotalFlow Flow Computers and Remote Controllers. ” concludes the advisory.

Firmware 125

Firmware Authentication Passwords Manufacturing 125

Security Affairs

DECEMBER 24, 2022

Security researcher ReSolver announced the discovery of hardcoded credentials (CVE-2022-40602) in ZyXEL LTE3301-M209 LTE indoor routers. Unlike the D-Link analysis, the researchers has no physical access to the device and attempted to retrieve the password from the config. 13 Sep 2022: Details sent to ZyXEL.

Firmware 52

Firmware Passwords Hacking Cybersecurity 52

Security Affairs

MAY 11, 2023

.” The vulnerabilities, tracked as CVE-2023-27357 , CVE-2023-27367 , CVE-2023-27368 , CVE-2023-27369 , CVE-2023-27370 , were demonstrated by Claroty researchers during the 2022 Pwn2Own Toronto hacking contest as part of an exploit. “NETGEAR is aware of multiple security vulnerabilities on the RAX30. We are in the final!

Hacking 92

Hacking Firmware Authentication DNS 92

Security Affairs

DECEMBER 22, 2022

The Zerobot botnet first appeared in the wild in November 2022 targeting devices running on Linux operating system. The Go-based botnet spreads by exploiting two dozen security vulnerabilities in the internet of things (IoT) devices and other applications. Adopt a comprehensive IoT security solution.

IoT 112

IoT DDOS Malware Firmware 112

Security Affairs

AUGUST 23, 2022

The vulnerability is an unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware, it was discovered by a security researcher that goes online with the moniker “Watchful IP.”. No username or password needed nor any actions need to be initiated by the camera owner. wrote the expert. “.

Hacking 112

Hacking Firmware Internet Internet 112

Security Affairs

AUGUST 9, 2023

Google researcher Daniel Moghimi devised a new side-channel attack technique Intel CPU, named Downfall, that relies on a flaw tracked as CVE-2022-40982. Malware can carry out a Downfall attack to steal sensitive information like passwords, encryption keys, and private data such as banking details, personal emails, and messages.

Firmware 62

Firmware Encryption Software Banking 62

Security Affairs

AUGUST 13, 2023

The CVE-2022-47391 received a severity rating of 7.5, “The discovery of these vulnerabilities highlights the critical importance of ensuring the security of industrial control systems and underscores the need for continuous monitoring and protection of these environments.” ” reads the advisory published by Microsoft.

Authentication 84

Authentication Firmware Hacking Passwords 84

Security Affairs

FEBRUARY 28, 2024

“As early as 2022, APT28 actors had utilized compromised EdgeRouters to facilitate covert cyber operations against governments, militaries, and organizations around the world.” Since September 2022, Moobot botnet was spotted targeting vulnerable D-Link routers. Upgrade to the latest firmware version.

Energy and Utilities 90

Energy and Utilities Government Firewall Malware 90

Security Affairs

APRIL 25, 2022

The alert includes indicators of compromise (IoCs) associated with BlackCat/ALPHV, as of mid-February 2022. The FBI is seeking any information that can be shared related to the operations of the BlackCat ransomware operation. Regularly back up data, air gap, and password-protect backup copies offline.

Ransomware 98

Ransomware Antivirus Passwords Malware 98

Security Affairs

AUGUST 4, 2022

Tens of router models from Taiwanese SOHO manufacturer DrayTek are affected by a critical, unauthenticated, remote code execution vulnerability, tracked as CVE-2022-32548, that can be exploited to fully compromise a vulnerable device and gain unauthorized access to the broader network.

Hacking 96

Hacking Internet Internet Passwords 96

Krebs on Security

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. “They were clearly reacting and trying to maintain control over components of the botnet,” Adamitis said.

Malware 211

Malware VPN Internet Internet 211

Security Affairs

JANUARY 25, 2022

This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, The news of the exploitation of the issue in the wild was confirmed by the security firm NCC Group. Experts also warned of some password spraying attacks attempting to compromise devices using default passwords. 37sv, 10.2.1.1-19sv,

Mobile 83

Mobile Passwords Firmware Firewall 83

Security Affairs

MAY 21, 2023

Please vote for Security Affairs ( [link] ) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini Please nominate Security Affairs as your favorite blog. We are in the final !

Data breaches 83

Data breaches Cybercrime Ransomware Passwords 83

Security Affairs

APRIL 14, 2022

According to the advisory that was issued with the help of leading cybersecurity firms (Dragos, Mandiant, Microsoft, Palo Alto Networks, and Schneider Electric), nation-state hacking groups were able to hack multiple industrial systems using a new ICS-focused malware toolkit dubbed PIPEDREAM that was discovered in early 2022.

Passwords 107

Passwords Architecture Backups Cyber Attacks 107

Security Affairs

JANUARY 16, 2022

Once the ransomware has infected a device, it moves all the files on the NAS into password-protected 7z archives and demands the payment of a $550 ransom. “It seems like a new version of the QLocker ransomware appeared on 06/1/2022. Up to date apps and firmware seem not to help either.”

Ransomware 106

Ransomware Encryption Backups Firmware 106

Security Affairs

MAY 14, 2023

Every week the best security articles from Security Affairs are free for you in your email box. Nominate Pierluigi Paganini and Security Affairs here here: [link] Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. We are in the final !

Data breaches 84

Data breaches DDOS Artificial Intelligence Ransomware 84

Security Affairs

OCTOBER 22, 2022

The Daixin Team is a ransomware and data extortion group that has been active since at least June 2022. “The actors have leveraged privileged accounts to gain access to VMware vCenter Server and reset account passwords [ T1098 ] for ESXi servers in the environment. If you use Remote Desktop Protocol (RDP), secure and monitor it.

Ransomware 65

Ransomware VPN Cybercrime Accountability 65

SecureWorld News

JUNE 13, 2023

It's estimated LockBit had nearly 1,100 victims in 2022 alone. Two-step phishing attacks involve threat actors using compromised vendors to target potential victims by creating convincing emails that resemble legitimate vendor communications, often related to DocuSign, orders, invoices, or tracking information.

Cyber threats 68

Cyber threats Malware Phishing Penetration Testing 68

Security Boulevard

JUNE 1, 2021

roundup of UK focused Cyber and Information Security News, Blog Posts, Reports and general Threat Intelligence from the previous calendar month, May 2021. The UK National Cyber Security Centre (NCSC) published its Smart Cities (connected places) guidance for UK local authorities. VULNERABILITIES AND SECURITY UPDATES.

Ransomware 105

Ransomware Passwords Scams Cyber Attacks 105

Security Affairs

MAY 19, 2023

The researchers first uncovered the operation of the Lemon Group in February 2022. Soon after the security firm published a report on the group, the gang rebranded under the name ‘Durian Cloud SMS’, but maintained the C2 infrastructure. ” The overlap suggests that the two groups likely collaborated at some point.

Mobile 82

Mobile Advertising Malware Cybercrime 82

ForAllSecure

APRIL 26, 2022

So there’s a need, a definite need, for information security professionals to have access to industrial control systems -- not virtual, but actual hands on systems -- so they can learn. In a moment I’ll introduce you to someone who is trying to do that--bring ICS equipment to security conferences.

Hacking 52

Hacking Energy and Utilities Manufacturing Firmware 52