Security Affairs

AUGUST 7, 2021

Threat actors are actively exploiting a critical authentication bypass issue (CVE-2021-20090 ) affecting home routers with Arcadyan firmware. Threat actors actively exploit a critical authentication bypass vulnerability, tracked as CVE-2021-20090 , impacting home routers with Arcadyan firmware to deploy a Mirai bot.

IoT 143

IoT Firmware Authentication Wireless 143

Security Affairs

NOVEMBER 1, 2021

The ATM black box attacks are quite popular in the cybercrime underground and several threat actors offer the hardware equipment and malware that could be used to compromise the ATMs. The vulnerabilities discovered by the security duo impacts the Wincor Cineo ATMs with the RM3 and CMD-V5 dispensers. Both issues received a CVSSv3.0

Hacking 116

Hacking Firmware Encryption Manufacturing 116

Security Affairs

JULY 31, 2022

increased rewards for info on North Korea-linked threat actors to $10 million Threat actors leverages DLL-SideLoading to spread Qakbot malware Zero Day attacks target online stores using PrestaShop? and Blackmatter ransomware U.S. and Blackmatter ransomware U.S. and Blackmatter ransomware U.S.

Firmware 71

Firmware Surveillance Malware DDOS 71

Security Affairs

DECEMBER 15, 2020

The CVE-2020-25183 is an improper authentication issue that could be exploited by an attacker to bypass the authentication between the MCL Smart Patient Reader and the Medtronic MyCareLink Smart mobile app. The flaw could be exploited by an attacker to remotely execute code taking over the device. ” states the advisory.

Firmware 101

Firmware Authentication Mobile IoT 101

Security Affairs

OCTOBER 9, 2022

BlackByte Ransomware abuses vulnerable driver to bypass security solutions Unpatched remote code execution flaw in Zimbra Collaboration Suite actively exploited VMware fixed a high-severity bug in vCenter Server Fortinet urges customers to immediately fix a critical authentication bypass flaw in FortiGate and FortiProxy Hacker stole $566 million worth (..)

Data breaches 87

Data breaches Firmware Ransomware Hacking 87

Security Affairs

AUGUST 24, 2021

Realtek published a security advisory on August 15 to warn customers about security updates to address vulnerabilities in its software developers kits (SDK) which is used by at least 65 separate vendors. On August 15, firmware security company IoT Inspector published details about the flaws.

IoT 124

IoT Firmware Internet Internet 124

Security Affairs

AUGUST 13, 2023

Threat actors can also compromise a data center by establishing a backdoor and abuse systems and devices spread malware on a large scale. The researchers presented their findings at the DEFCON security conference today. CVE-2023-3266: Improperly Implemented Security Check for Standard (Auth Bypass; CVSS 7.5)

Hacking 85

Hacking Firmware Authentication Software 85

Security Affairs

APRIL 23, 2021

The malware moves all files stored on the device to password-protected 7zip archives and demand the payment of a $550 ransom. The Taiwanese vendor published a security advisory to warn its customers of the ongoing attacks and is urging them to install the latest Malware Remover version and scan their devices for indicators of compromise.

Ransomware 119

Ransomware Backups Media Malware 119

Security Affairs

APRIL 25, 2021

“The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. ” states the report published by Eye security.

Firmware 112

Firmware Passwords Authentication Wireless 112

Security Affairs

DECEMBER 12, 2020

“Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a function that could reboot the device remotely.” ” reads the security advisory published by CISA. Update the firmware on CompactRIO controllers to v8.5

Firmware 87

Firmware Manufacturing Software Authentication 87

Security Affairs

FEBRUARY 28, 2024

In April 2023, FortiGuard Labs researchers observed a hacking campaign targeting Cacti ( CVE-2022-46169 ) and Realtek ( CVE-2021-35394 ) vulnerabilities to spread ShellBot and Moobot malware. The court order allowed authorities to use the Moobot malware to copy and delete stolen and malicious data and files from compromised routers.

Energy and Utilities 97

Energy and Utilities Government Firewall Malware 97

Security Affairs

MARCH 19, 2022

“As a result, AvosLocker indicators of compromise (IOCs) vary between indicators specific to AvosLocker malware and indicators specific to the individual affiliate responsible for the intrusion.” Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. Disable unused ports.

Ransomware 98

Ransomware DDOS Passwords Backups 98

Security Affairs

APRIL 16, 2021

Uptycs’ threat research team recently detected several variants of the Linux-based botnet malware family, “ Gafgyt ,”some of them re-used Mirai code. . Gafgyt (also known as Bashlite) is a prominent malware family for *nix systems, which mainly target vulnerable IoT devices like Huawei routers, Realtek routers and ASUS devices.

Malware 122

Malware DDOS IoT Firmware 122

Security Affairs

SEPTEMBER 2, 2021

As of today, the researchers discovered 16 security vulnerabilities, with 20 common vulnerability exposures (CVEs) already assigned and four vulnerabilities are pending CVE assignment from Intel and Qualcomm. Crashes generally trigger a fatal assertion, segmentation faults due to a buffer or heap overflow within the SoC firmware.

Firmware 89

Firmware Manufacturing IoT Technology 89

Security Affairs

JULY 10, 2020

The backdoor accounts in the firmware of 29 FTTH Optical Line Termination (OLT) devices from popular vendor C-Data. The security duo, composed of Pierre Kim and Alexandre Torres, disclosed seven vulnerabilities in the firmware of FTTH OLT devices manufactured by C-Data. ” reads the analysis published by the experts.

Firmware 98

Firmware Accountability Advertising Manufacturing 98

Security Affairs

SEPTEMBER 8, 2020

“The authentication function contains undocumented code which provides the ability to authenticate as root without having to know the actual root password. An adversary with the private key can remotely authenticate to the management interface as root.” ” reads the advisory published by the expert.

Firmware 88

Firmware Wireless Authentication Advertising 88

Security Affairs

APRIL 25, 2022

The BlackCat/ALPHV a Ransomware was first discovered in December by malware researchers from Recorded Future and MalwareHunterTeam. The malware is the first professional ransomware strain that was written in the Rust programming language. Use multifactor authentication where possible. hard drive, storage device, the cloud).

Ransomware 106

Ransomware Antivirus Passwords Malware 106

Security Affairs

JULY 25, 2020

Unfortunately, some of the impacted models have reached their End-of-Support (“EOS”)/ End-of-Life (“EOL”) date, which means they wouldn’t receive security updates to fix the issues. B09 (and below) will receive no security updates remaining vulnerable.

Firmware 101

Firmware Advertising Authentication Hacking 101

Security Affairs

APRIL 19, 2023

Most of the APT28s’ campaigns leveraged spear-phishing and malware-based attacks. According to the joint report, APT28 exploited the known vulnerability to carry out reconnaissance and reploy malware on unpatched Cisco routers. For some of the targeted devices, threat actors abused an SNMP exploit to deploy the Jaguar Tooth Malware.

Malware 84

Malware Firmware Government Education 84

Security Affairs

SEPTEMBER 3, 2019

Researchers at firmware security firm Eclypsium discovered multiple vulnerabilities referred as USBAnywhere that could be exploited to potentially allow an attacker to take over the baseboard management controller (BMC) for three different models of Supermicro server boards: the X9, X10, and X11. ” continues the analysis.

Hacking 84

Hacking Firmware Media Authentication 84

Security Affairs

AUGUST 12, 2019

. “Our research shows how an attacker in close proximity (WiFi), or an attacker who already hijacked our PC (USB), can also propagate to and infect our beloved cameras with malware. The expert was able to access the keys for verifying the authenticity of the firmware and for encrypting it. Pierluigi Paganini.

Firmware 87

Firmware Ransomware Wireless Encryption 87

Security Affairs

SEPTEMBER 3, 2021

Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., Install updates/patch operating systems, software, and firmware as soon as they are released. Use multifactor authentication with strong pass phrases where possible.

Ransomware 97

Ransomware Passwords Backups Firmware 97

Security Affairs

JULY 1, 2020

Four of flaws have been rated high severity , they can be exploited by an unauthenticated attacker with network access to the vulnerable Netgear device to execute arbitrary code with admin or root privileges, and to bypass authentication. Authentication is not required to exploit this vulnerability.” ” states the CERT/CC.

Authentication 128

Authentication Firmware Hacking Mobile 128

Malwarebytes

MARCH 17, 2021

PYSA, aka Mespinoza, is a malware capable of exfiltrating data and encrypting users’ critical files and data stored on their systems. To prevent attacks: Install security updates for operating systems, software, and firmware as soon as they are released. Use multi-factor authentication wherever possible.

Education 107

Education Ransomware Phishing Passwords 107

Security Affairs

MARCH 26, 2021

Mamba ransomware is one of the first malware that encrypted hard drives rather than files that was detected in public attacks. Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., ” continues the alert.

Ransomware 144

Ransomware Encryption Passwords Malware 144

Security Affairs

JANUARY 22, 2021

The experts discovered that Amazon did not verify the authenticity of the email sender, this means that attackers can spoof an email address that is present in the list of approved addresses. Experts also published a video PoC of the KindleDRIP exploit chain on a new Kindle 10 running firmware version 5.13.2. Pierluigi Paganini.

Hacking 137

Hacking Authentication Firmware Phishing 137

Security Affairs

AUGUST 13, 2022

The FBI has observed instances where Zeppelin actors executed their malware multiple times within a victim’s network, resulting in the creation of different IDs or file extensions, for each instance of an attack; this results in the victim needing several unique decryption keys.” ” reads the joint advisory.

Ransomware 85

Ransomware Encryption Firmware Backups 85

Malwarebytes

SEPTEMBER 3, 2021

Rise in malware. As we pointed out in our State of Malware report, published earlier this year, Malwarebytes recorded an eye-watering 607% increase in malware detections in the agriculture sector in 2020. Install updates/patch operating systems, software, and firmware as soon as they are released.

Ransomware 139

Ransomware Manufacturing Passwords Internet 139

Security Affairs

OCTOBER 26, 2021

Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. Use double authentication when logging into accounts or services. Implement network segmentation, such that all machines on your network are not accessible from every other machine. Disable hyperlinks in received emails.

Ransomware 129

Ransomware Firmware Antivirus Accountability 129

Security Affairs

APRIL 14, 2022

According to the advisory that was issued with the help of leading cybersecurity firms (Dragos, Mandiant, Microsoft, Palo Alto Networks, and Schneider Electric), nation-state hacking groups were able to hack multiple industrial systems using a new ICS-focused malware toolkit dubbed PIPEDREAM that was discovered in early 2022.

Passwords 115

Passwords Architecture Backups Cyber Attacks 115

Security Affairs

DECEMBER 17, 2020

Patch operating systems, software, firmware, and endpoints. Apply two-factor authentication to user login credentials, receiving responses by text rather than email as actors may be in control of victim email accounts. Audit user accounts regularly, particularly Remote Monitoring and Management accounts that are publicly accessible.

Ransomware 140

Ransomware Backups Firmware Accountability 140

Security Affairs

MAY 8, 2023

The authenticity of the leaked private key was confirmed by Alex Matrosov, founder of firmware security firm Binarly. The Money Message group initially threatened to publish the stolen files by April 12, 2023, if the company will not pay the ransom.

Data breaches 79

Data breaches Ransomware Firmware Manufacturing 79

Security Affairs

AUGUST 7, 2020

Several media outlets independently analyzed the data leak and verified the authenticity of the data. The engineering received the files from an anonymous hacker who claimed to have hacked the company earlier this year, the experts believe that this leak is just a first lot on a larger collection. ” reported ZDNet.

Firmware 65

Firmware Advertising Engineering Hacking 65

Security Affairs

JUNE 22, 2019

The ADB could be abused by malware to target Android phones through the port 5555. “We observed a new cryptocurrency-mining botnet malware that arrives via open ADB (Android Debug Bridge) ports and can spread via SSH. “This botnet malware also tries to block its competitor by modifying /etc/hosts.

Cryptocurrency 67

Cryptocurrency Malware Advertising Firmware 67

Security Affairs

MAY 13, 2021

Require multi-factor authentication for remote access to OT and IT networks. Update software , including operating systems, applications, and firmware on IT network assets, in a timely manner. After assessing risks, if RDP is deemed operationally necessary, restrict the originating sources and require multi-factor authentication.

Ransomware 110

Ransomware Healthcare Phishing Risk 110

Security Affairs

OCTOBER 22, 2022

Below are the mitigations provided in the alert: Install updates for operating systems, software, and firmware as soon as they are released. Implement and enforce multi-layer network segmentation with the most critical communications and data resting on the most secure and reliable layer.

Ransomware 68

Ransomware VPN Cybercrime Accountability 68

Security Affairs

APRIL 2, 2021

. • Implement a recovery plan to restore sensitive or proprietary data from a physically separate, segmented, secure location (e.g., Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. • Use multifactor authentication where possible. hard drive, storage device, the cloud).

Passwords 66

Passwords Government Firmware Accountability 66