The Hacker News

SEPTEMBER 9, 2021

Network security solutions provider Fortinet confirmed that a malicious actor had unauthorizedly disclosed VPN login names and passwords associated with 87,000 FortiGate SSL-VPN devices. While they may have since been patched, if the passwords were not reset, they remain

VPN 138

VPN Passwords Accountability Network Security 138

Security Affairs

APRIL 19, 2025

Arctic Wolf has uncovered an active campaign, running from January to April 2025, targeting SonicWall SMA 100 series appliances to steal VPN credentials. Threat actors were spotted exploiting the default super admin account (admin@LocalDomain), which often still uses the weak default password password.

Passwords 108

Passwords VPN Firewall Accountability 108

Krebs on Security

FEBRUARY 19, 2020

The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords. It is perhaps best known for selling virtual private networking (VPN) software that lets users remotely access networks and computers over an encrypted connection.

VPN 363

VPN Passwords Software Telecommunications 363

Security Affairs

OCTOBER 29, 2024

The two infostealers allowed operators to harvest usernames, passwords, contact info, and crypto-wallets from victims, the threat actors sold this data to criminals for financial theft and hacking. Use a password manager : Simplifies managing strong, unique passwords across accounts.

Identity Theft 127

Identity Theft Passwords Malware Banking 127

Krebs on Security

NOVEMBER 21, 2020

And in May of this year, GoDaddy disclosed that 28,000 of its customers’ web hosting accounts were compromised following a security incident in Oct. “This gave the actor the ability to change DNS records and in turn, take control of a number of internal email accounts. . 2019 that wasn’t discovered until April 2020.

Cryptocurrency 364

Cryptocurrency VPN Scams Social Engineering 364

Adam Levin

DECEMBER 16, 2020

Don’t re-use passwords: Yes, keeping track of passwords for all of your accounts can be a chore, but using the same password means that one breached account can be used to others that use the same user credentials. If you’re having difficulty keeping track of passwords, consider using a password manager.

VPN 245

VPN Antivirus Passwords Backups 245

Schneier on Security

DECEMBER 4, 2018

There are lots of articles about there telling people how to better secure their computers and online accounts. To remain anonymous and secure on the Internet, invest in a Virtual Private Network account, but remember, the bad guys are very smart, so by the time this column runs, they may have figured out a way to hack into a VPN.

Accountability 272

Accountability Passwords VPN Mobile 272

Security Affairs

JANUARY 1, 2021

Zyxel addressed a critical flaw in its firmware, tracked as CVE-2020-29583 , related to the presence of a hardcoded undocumented secret account. The Taiwanese vendor Zyxel has addressed a critical vulnerability in its firmware related to the presence of a hardcoded undocumented secret account. “Firmware version 4.60 patch 0).

Firewall 145

Firewall VPN Firmware Passwords 145

Security Affairs

MAY 29, 2024

Check Point released hotfixes for a VPN zero-day vulnerability, tracked as CVE-2024-24919, which is actively exploited in attacks in the wild. Check Point released hotfixes to address a VPN zero-day vulnerability, tracked as CVE-2024-24919 , which is actively being exploited in attacks in the wild.

VPN 127

VPN Passwords Authentication Accountability 127

Krebs on Security

OCTOBER 21, 2019

Antivirus and security giant Avast and virtual private networking (VPN) software provider NordVPN each today disclosed months-long network intrusions that — while otherwise unrelated — shared a common cause: Forgotten or unknown user accounts that granted remote access to internal systems with little more than a password.

Accountability 175

Accountability VPN Software Antivirus 175

Security Affairs

MARCH 29, 2024

Cisco warns customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services of Cisco Secure Firewall devices. Cisco is warning customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services configured on Cisco Secure Firewall devices.

Firewall 133

Firewall Passwords VPN Authentication 133

Malwarebytes

MARCH 3, 2021

Detailed credentials for more than 21 million mobile VPN app users were swiped and advertised for sale online last week, offered by a cyber thief who allegedly stole user data collected by the VPN apps themselves. So this is a mess, and a timely reminder of why trust in a VPN provider is so crucial.

VPN 145

VPN Passwords Internet Internet 145

Security Affairs

JANUARY 14, 2025

Threat actors gained unauthorized access to network devices, created accounts, and modified configurations. The campaign likely began in November 2024, the campaign unfolded in four phases: vulnerability scanning (Nov 1623, 2024), reconnaissance (Nov 2227), SSL VPN setup (Dec 47), and lateral movement (Dec 1627).

Firewall 84

Firewall VPN Accountability Firmware 84

Krebs on Security

AUGUST 21, 2020

The advisory came less than 24 hours after KrebsOnSecurity published an in-depth look at a crime group offering a service that people can hire to steal VPN credentials and other sensitive data from employees working remotely during the Coronavirus pandemic. authenticate the phone call before sensitive information can be discussed.

VPN 363

VPN Social Engineering Authentication Engineering 363

Krebs on Security

AUGUST 19, 2020

But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees. The employee phishing page bofaticket[.]com. Image: urlscan.io. ” SPEAR VISHING.

Phishing 363

Phishing VPN Social Engineering Media 363

Krebs on Security

JULY 18, 2022

911 says its network is made up entirely of users who voluntarily install its “free VPN” software. In this scenario, users indeed get to use a free VPN service, but they are often unaware that doing so will turn their computer into a proxy that lets others use their Internet address to transact online. “The 911[.]re

VPN 357

VPN Computers and Electronics Antivirus Software 357

The Last Watchdog

MARCH 6, 2021

•Use strong passwords. It is essential to ensure that all accounts are protected with strong passwords. To this day, a significant amount of people still use the password across multiple accounts, which makes it much simpler for a cybercriminal to compromise a password and take over accounts.

VPN 214

VPN Passwords Firewall Risk 214

Krebs on Security

JULY 10, 2022

Twice in the past month KrebsOnSecurity has heard from readers who’ve had their accounts at big-three credit bureau Experian hacked and updated with a new email address that wasn’t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts.

Accountability 336

Accountability Passwords Authentication Password Management 336

Adam Levin

OCTOBER 16, 2020

While Barnes & Noble has yet to provide details of the nature of the cyberattack, a security researcher pointed out that the company’s VPN servers had not been patched against a critical vulnerability. The post Barnes & Noble Experiences Major Data Breach appeared first on Adam Levin.

Data breaches 286

Data breaches VPN Passwords Accountability 286

SecureWorld News

MAY 28, 2024

Threat actors are targeting Check Point Remote Access VPN devices in an ongoing campaign to breach enterprise networks, the company has warned in a new advisory. We have recently witnessed compromised VPN solutions, including various cyber security vendors.

VPN 108

VPN Passwords Authentication Architecture 108

The Last Watchdog

JULY 11, 2022

It is astounding that billions of online accounts have been breached over the past 18 years and that US consumer accounts are by far the most compromised. Related: VPNs vs ZTNA. It’s in findings of a deep dive data analytics study led by Surfshark , a supplier of VPN services aimed at the consumer and SMB markets.

VPN 229

VPN Data breaches Internet Internet 229

Security Affairs

NOVEMBER 25, 2024

“A command injection vulnerability in the IPSec VPN feature of some firewall versions could allow an unauthenticated attacker to execute some OS commands on an affected device by sending a crafted username to the vulnerable device.” for ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN series. .”

Firewall 76

Firewall Ransomware VPN Firmware 76

Krebs on Security

JULY 8, 2019

Russian security firm Kaspersky Lab estimated that by the time the program ceased operations, GandCrab accounted for up to half of the global ransomware market. ” Dedserver also heavily promoted a virtual private networking (VPN) service called vpn-service[.]us Vpn-service[.]us Vpn-service[.]us HEAVY METALL.

Ransomware 278

Ransomware Accountability Cybercrime Passwords 278

Security Affairs

NOVEMBER 27, 2020

The global impact of the Fortinet 50.000 VPN leak posted online, with many countries impacted, including Portugal. A compilation of one-line exploit tracked as CVE-2018-13379 and that could be used to steal VPN credentials from nearly 50.000 Fortinet VPN devices has posted online. Impact this leak. FortiOS 5.6 – 5.6.3

VPN 145

VPN Banking Passwords Malware 145

Security Affairs

MAY 28, 2021

Researchers from FireEye warn that China-linked APT groups continue to target Pulse Secure VPN devices to compromise networks. Cybersecurity researchers from FireEye warn once again that Chinese APT groups continue to target Pulse Secure VPN devices to penetrate target networks and deliver malicious web shells to steal sensitive information.

VPN 142

VPN Government Malware Hacking 142

Webroot

MAY 9, 2025

Little do you know, clicking that link could open the door for scammers to steal your identity, empty your bank account, or even plant malicious software (malware) on your device. The goal is to get you to give up sensitive personal details that can be used to hack into your accounts, and they are alarmingly successful.

Scams 72

Scams Mobile Banking VPN 72

Hacker's King

JANUARY 1, 2025

You may also like to read: Instagram Hacked: Top 5 Ways to Protect Your Account Ways to Secure Your Twitter Account Set a Strong Password - Setting a strong password is the very first step to secure your Twitter account. It enables us to make our accounts more secure. Be cautious with public Wi-Fi.

Accountability 52

Accountability Hacking Passwords Scams 52

Pen Test Partners

AUGUST 29, 2024

TL;DR Strong passwords : Use a password manager. This makes it harder for unauthorised users to gain access even if they have your password. Secure networks : Avoid using untrusted public Wi-Fi to access social media accounts, instead, use mobile data. These systems store your passwords in a single encrypted vault.

Media 115

Media Accountability Password Management Passwords 115

Krebs on Security

APRIL 18, 2023

Riley Kilmer is co-founder of Spur.us , a company that tracks thousands of VPN and proxy networks, and helps customers identify traffic coming through these anonymity services. MrMurza also told the admin that his account number at the now-defunct virtual currency Liberty Reserve was U1018928. Image: spur.us.

Malware 303

Malware Passwords Accountability Advertising 303

Webroot

MARCH 3, 2025

Common attacks to consumer protection Identity theft and fraud Some common types of identity theft and fraud include account takeover fraud , when criminals use stolen personal information such as account numbers, usernames, or passwords to hijack bank accounts, credit cards, and even email and social media accounts.

Consumer Protection 99

Consumer Protection Identity Theft Scams Social Engineering 99

Security Affairs

FEBRUARY 20, 2025

The Orange Cyberdefense CERT investigated four attackers with a similar initial access vector consisting of thecompromise of a Check Point VPN appliance. The experts believe threat actors exploited the zero-dayCVE-2024-24919 in Check Point Security Gateways with Remote Access VPN or Mobile Access features.

Healthcare 87

Healthcare Ransomware VPN Malware 87

Malwarebytes

MARCH 17, 2025

If enough victims unwittingly send their passwords, cyber thieves could bundle the login credentials for sale on the dark web. That said, it’s inspiring to see that 41% of people “download or install a VPN” to provide an extra level of security when browsing on public Wi-Fi. Use a password manager and 2FA.

VPN 104

VPN Passwords Scams Backups 104

Troy Hunt

MARCH 5, 2021

Not just data breaches, but noteworthy data breaches; the VPN ones for being pretty shady, Oxfam because it included my data which was posted to a hacking forum, Ticketcounter because of the interactions I had with them during the disclosure process and Gab because, well, everything about Gab is always weird.

Data breaches 250

Data breaches VPN Hacking Passwords 250

Krebs on Security

SEPTEMBER 2, 2021

For the past three years, the source — we’ll call him “Bill” to preserve his requested anonymity — has been watching one group of threat actors that is mass-testing millions of usernames and passwords against the world’s major email providers each day. Why go after hotel or airline rewards?

Accountability 347

Accountability Authentication Passwords Hacking 347

Krebs on Security

DECEMBER 3, 2021

More commonly, that access is purchased from a cybercriminal broker who specializes in acquiring remote access credentials — such as usernames and passwords needed to remotely connect to the target’s network. The username associated with that account was “ bo3dom.” com back in 2011, and sanjulianhotels[.]com

Ransomware 353

Ransomware Passwords Accountability Cybercrime 353

Security Affairs

DECEMBER 31, 2021

The Have I Been Pwned data breach notification service now includes credentials for 441K accounts that were stolen by RedLine malware. The service now includes credentials for 441K accounts stolen by the popular info-stealer. The data included usernames, email addresses and plain text passwords.” Pierluigi Paganini.

Accountability 145

Accountability Malware Data breaches Passwords 145

Krebs on Security

FEBRUARY 26, 2023

million customers, including website administrator passwords, sFTP credentials, and private SSL keys; -December 2022: Hackers gained access to and installed malware on GoDaddy’s cPanel hosting servers that “intermittently redirected random customer websites to malicious sites.”

Hacking 330

Hacking Social Engineering Phishing Scams 330