Cybercrime, Firmware and IoT - Cyber Security Informer

KrebsOnSecurity Hit By Huge New IoT Botnet “Meris”

Krebs on Security

SEPTEMBER 10, 2021

The assault came from “ Meris ,” the same new “Internet of Things” (IoT) botnet behind record-shattering attacks against Russian search giant Yandex this week and internet infrastructure firm Cloudflare earlier this summer. “The largest share belongs to the version of firmware previous to the current stable one.”

IoT

IoT DDOS Internet Internet

BotenaGo botnet targets millions of IoT devices using 33 exploits

Security Affairs

NOVEMBER 11, 2021

Researchers at AT&T discovered a new BotenaGo botnet that is using thirty three exploits to target millions of routers and IoT devices. BotenaGo is a new botnet discovered by researchers at AT&T that leverages thirty three exploits to target millions of routers and IoT devices. 7)C0 NAS520 before firmware V5.21(AASZ.3)C0

IoT

IoT Firmware Malware Wireless

U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog

Security Affairs

NOVEMBER 5, 2024

The company discovered the zero-day vulnerabilities in IoT live-streaming cameras, used in industrial operations, healthcare, and other sensitive environments. Affected devices use VHD PTZ camera firmware < 6.3.40 Organizations using VHD PTZ camera firmware < 6.3.40 Organizations using VHD PTZ camera firmware < 6.3.40

Firmware

Firmware Manufacturing Authentication IoT

BadBox rapidly grows, 190,000 Android devices infected

Security Affairs

DECEMBER 21, 2024

In October 2023, cybersecurity researchers at Human Security discovered a global network of consumer products, dubbed BADBOX, with firmware backdoors installed and sold through a compromised hardware supply chain. Products containing the malicious backdoor have been found on public school networks throughout the United States.

Firmware

Firmware Malware Internet Internet

A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs

Security Affairs

DECEMBER 26, 2024

“Using a Mirai malware variant that incorporates ChaCha20 and XOR decryption algorithms, it has been seen compromising vulnerable Internet of Things (IoT) devices in the wild, such as the DigiEver DVR, and TP-Link devices through CVE-2023-1389.” .” reads the analysis published by Akamai. in newer ones.

Manufacturing

Manufacturing Malware Firmware IoT

MikroTik botnet relies on DNS misconfiguration to spread malware

Security Affairs

JANUARY 16, 2025

The researchers found that the botnet comprises MikroTik routers with various firmware versions, including recent ones. .” The analysis of the headers of the spam messages revealed a botnet of ~13,000 hijacked MikroTik devices, forming a network capable of executing large-scale malicious activities.

DNS

DNS Malware Firmware Authentication

Realtek SDK flaws exploited to deliver Mirai bot variant

Security Affairs

AUGUST 24, 2021

On August 15, firmware security company IoT Inspector published details about the flaws. “On August 16th, three days ago, multiple vulnerabilities in a software SDK distributed as part of Realtek chipsets were disclosed by IoT Inspector Research Lab [1]. ” reported IoT Inspector.

IoT

IoT Firmware Internet Internet

Spyware in the IoT – the Biggest Privacy Threat This Year

SiteLock

AUGUST 27, 2021

The consequences of which are not only born by companies who are the primary targets of cybercrime. Simply defined, the internet of things (IoT) is a network of Internet-connected objects able to collect and exchange data. The first IoT casualties? Your home systems are more vulnerable than you think. Think again.

IoT

IoT Spyware VPN Passwords

Moobot botnet spreads by exploiting CVE-2021-36260 flaw in Hikvision products

Security Affairs

DECEMBER 8, 2021

The vulnerability is an unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware, it was discovered by a security researcher that goes online with the moniker “Watchful IP.”. The expert pointed out that every firmware developed since 2016 has been tested and found to be vulnerable.

Firmware

Firmware DDOS Malware IoT

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

JULY 25, 2023

Proxy services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they make it difficult to trace malicious traffic to its original source. WHO’S BEHIND SOCKSESCORT? com, super-socks[.]com,

Malware

Malware VPN Internet Internet

New Mirai botnet targets TBK DVRs by exploiting CVE-2024-3721

Security Affairs

JUNE 9, 2025

“Exploiting known security flaws in IoT devices and servers that haven’t been patched, along with the widespread use of malware targeting Linux-based systems, leads to a significant number of bots constantly searching the internet for devices to infect.” ” concludes the report. ” concludes the report.

IoT

IoT Firmware Malware Architecture

New BrakTooth flaws potentially impact millions of Bluetooth-enabled devices

Security Affairs

SEPTEMBER 2, 2021

. “we disclose BrakTooth, a family of new security vulnerabilities in commercial BT stacks that range from denial of service (DoS) via firmware crashes and deadlocks in commodity hardware to arbitrary code execution (ACE) in certain IoTs.” ” reads the post published by the researchers. Pierluigi Paganini.

Firmware

Firmware Manufacturing IoT Technology

A new Zerobot variant spreads by exploiting Apache flaws

Security Affairs

DECEMBER 22, 2022

Microsoft Threat Intelligence Center (MSTIC) researchers discovered a new variant of the Zerobot botnet (aka ZeroStresser) that was improved with the capabilities to target more Internet of Things (IoT) devices. Adopt a comprehensive IoT security solution. The IT giant is tracking this cluster of threat activity as DEV-1061.

IoT

IoT DDOS Malware Firmware

Mozi P2P Botnet also targets Netgear, Huawei, and ZTE devices

Security Affairs

AUGUST 20, 2021

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware , it appeared on the threat landscape in late 2019. Now researchers from Microsoft Security Threat Intelligence Center and Section 52 at Azure Defender for IoT have monitored a new evolution of the threat that extent the list of targets. .

IoT

IoT DNS Manufacturing Firmware

Vo1d malware infected 1.3 Million Android-based TV Boxes in 197 countries

Security Affairs

SEPTEMBER 13, 2024

Users may also mistakenly believe TV boxes are more secure than smartphones and are less likely to install antivirus software, increasing their risk when downloading third-party apps or unofficial firmware.

Malware

Malware Firmware Antivirus Manufacturing

Beastmode Mirai botnet now includes exploits for Totolink routers

Security Affairs

APRIL 2, 2022

The threat actors added TOTOLINK exploits just a week after the exploit codes were publicly released on GitHub in the attempt to compromise the largest number of devices as possible before the owners upgrade to the latest firmware releases. TOTOLINK has already addressed these flaws with the release of new firmware for vulnerable devices.

DDOS

DDOS Firmware Surveillance IoT

Beyond the Office: Securing Home Devices and Networks Against Corporate Breaches

SecureWorld News

OCTOBER 8, 2023

Use the administrator account only for maintenance, software installation, or firmware updates. Consider segmenting your Wi-Fi networks: one for main use, one for guests, and another for IoT devices. Attention should be paid to protecting routers and updating their firmware. Opt for strong, hard-to-crack passwords.

Firmware

Firmware IoT Accountability Passwords

Daixin Team targets health organizations with ransomware, US agencies warn

Security Affairs

OCTOBER 22, 2022

US government agencies warned that the Daixin Team cybercrime group is actively targeting the U.S. CISA, the FBI, and the Department of Health and Human Services (HHS) warned that the Daixin Team cybercrime group is actively targeting U.S. Use monitoring tools to observe whether IoT devices are behaving erratically due to a compromise.

Ransomware

Ransomware VPN Cybercrime Accountability

SiteLock’s Top Five Cybersecurity Predictions For 2020

SiteLock

AUGUST 27, 2021

Internet of Things (IoT) devices will be a cybercriminal’s “fifth column” in 2020. IoT devices are popular among consumers who thrive on efficiency. As the popularity of IoT devices continues to grow, SiteLock researchers predict the number of compromised devices will follow suit.

Cybersecurity

Cybersecurity Phishing Data breaches IoT

A new wave of DeadBolt Ransomware attacks hit QNAP NAS devices ?

Security Affairs

MARCH 22, 2022

At the end of January, QNAP forced the firmware update for its Network Attached Storage (NAS) devices to protect its customers against the DeadBolt ransomware. ” After QNAP forced the firmware security update, the number of infections dropped to less than 300 in March. It was looking like this problem was behind us.”

Ransomware

Ransomware Firmware Internet Internet

Top 9 Cybersecurity Challenges SMEs Currently Face

Responsible Cyber

APRIL 8, 2020

IoT Opens Excessive Entry Points. The Internet of Things (IoT) is undeniably the future of technology. It is imperative for employers to now ensure that all IoT devices are set up correctly and no room for a network breach is left. Indeed, it has added convenience to our hectic schedules. Phishing and Spear Phishing.

Cybersecurity

Cybersecurity DDOS Small Business Phishing

Advanced threat predictions for 2023

SecureList

NOVEMBER 14, 2022

A recent leak has put it in the hands of cybercrime actors and it is very likely that by the end of the year we will see it involved in APT cases too. In both cases, we described new UEFI firmware bootkits that managed to propagate malicious components from the deepest layers of the machine up to Windows’ user-land.

Firmware

Firmware Surveillance Mobile Telecommunications

Advanced threat predictions for 2025

SecureList

NOVEMBER 25, 2024

For instance, several days ago, personal data related to Amazon employees that was allegedly leaked over the course of the MOVEit vulnerability attack was leaked on a cybercrime forum. Additionally, IoT devices frequently run on embedded systems with firmware that can be easily analyzed for vulnerabilities.

IoT

IoT Energy and Utilities Phishing Cryptocurrency

Geopolitical Cyber Attacks?—?The New Battlefield

Security Boulevard

MAY 2, 2022

According to a survey in CisoMag ,84% of organizations have deployed IoT devices on their corporate networks, and more than 50% don’t maintain the necessary security measures beyond default passwords. Many IOT/OT/ICS devices do not have enough physical device capacity to load classic IT security prevention tools. Mostly like, no.

Cyber Attacks

Cyber Attacks IoT Firmware Social Engineering

DDoS attacks in Q4 2020

SecureList

FEBRUARY 16, 2021

After the attacks came to light, the manufacturer promptly released a firmware update for configuring verification of incoming requests. Consequently, the victims received reply packets several times larger in size. In the case of Citrix devices, the amount of junk traffic could increase by up to 36 times.

DDOS

DDOS Cryptocurrency Marketing Internet

Zyxel 0day Affects its Firewall Products, Too

Krebs on Security

FEBRUARY 26, 2020

This week’s story on the Zyxel patch was prompted by the discovery that exploit code for attacking the flaw was being sold in the cybercrime underground for $20,000. “Hotfixes have been released immediately, and the standard firmware patches will be released in March.” Patch 0 through ZLD V4.35 Patch 0 through ZLD V4.35

Firewall

Firewall Firmware VPN IoT

Beware the Cyber Ghouls: Spooky Threats Lurking in Digital Shadows

SecureWorld News

OCTOBER 31, 2024

Spooky fact : The infamous Mirai botnet attack in 2016 turned more than 600,000 IoT devices into cyber zombies, leading to one of the most significant DDoS attacks in history. Warding off zombies : Regularly update device firmware, patch IoT devices, and monitor for unusual traffic patterns.

IoT

IoT Phishing DDOS Backups

Interview With a Crypto Scam Investment Spammer

Krebs on Security

MAY 22, 2023

This email address is also connected to accounts on several Russian cybercrime forums, including “ __edman__ ,” who had a history of selling “logs” — large amounts of data stolen from many bot-infected computers — as well as giving away access to hacked Internet of Things (IoT) devices.

Scams

Scams DDOS Cryptocurrency Accountability

Cyber Security Informer

KrebsOnSecurity Hit By Huge New IoT Botnet “Meris”

BotenaGo botnet targets millions of IoT devices using 33 exploits

Trending Sources

U.S. CISA adds PTZOptics camera bugs to its Known Exploited Vulnerabilities catalog

BadBox rapidly grows, 190,000 Android devices infected

A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs

MikroTik botnet relies on DNS misconfiguration to spread malware

Realtek SDK flaws exploited to deliver Mirai bot variant

Spyware in the IoT – the Biggest Privacy Threat This Year

Moobot botnet spreads by exploiting CVE-2021-36260 flaw in Hikvision products

Who and What is Behind the Malware Proxy Service SocksEscort?

New Mirai botnet targets TBK DVRs by exploiting CVE-2024-3721

New BrakTooth flaws potentially impact millions of Bluetooth-enabled devices

A new Zerobot variant spreads by exploiting Apache flaws

Mozi P2P Botnet also targets Netgear, Huawei, and ZTE devices

Vo1d malware infected 1.3 Million Android-based TV Boxes in 197 countries

Beastmode Mirai botnet now includes exploits for Totolink routers

Beyond the Office: Securing Home Devices and Networks Against Corporate Breaches

Daixin Team targets health organizations with ransomware, US agencies warn

SiteLock’s Top Five Cybersecurity Predictions For 2020

A new wave of DeadBolt Ransomware attacks hit QNAP NAS devices ?

Top 9 Cybersecurity Challenges SMEs Currently Face

Advanced threat predictions for 2023

Advanced threat predictions for 2025

Geopolitical Cyber Attacks?—?The New Battlefield

DDoS attacks in Q4 2020

Zyxel 0day Affects its Firewall Products, Too

Beware the Cyber Ghouls: Spooky Threats Lurking in Digital Shadows

Interview With a Crypto Scam Investment Spammer

Stay Connected