Hacking, Internet, Malware and VPN - Cyber Security Informer

Russian internet watchdog Roskomnadzor bans six more VPN services

Security Affairs

DECEMBER 2, 2021

Russia’s internet watchdog, ‘Roskomnadzor’, has announced the ban of other VPN products, 15 VPN services are now illegal in Russia. Russian communications watchdog Roskomnadzor tightens the control over the Internet and blocked access to six more VPN services. SecurityAffairs – hacking, VPN services).

VPN

VPN Internet Internet Media

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

JULY 25, 2023

Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed AVrecon that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. ” According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies. SocksEscort[.]com

Malware

Malware VPN Internet Internet

Treasury Sanctions Creators of 911 S5 Proxy Botnet

Krebs on Security

MAY 28, 2024

Department of the Treasury today unveiled sanctions against three Chinese nationals for allegedly operating 911 S5 , an online anonymity service that for many years was the easiest and cheapest way to route one’s Web traffic through malware-infected computers around the globe. based startup that tracks proxy and VPN services.

VPN

VPN Banking Cybercrime Internet

China-linked APT used Pulse Secure VPN zero-day to hack US defense contractors

Security Affairs

APRIL 20, 2021

At least one China-linked APT group exploited a new zero-day flaw in Pulse Secure VPN equipment to break into the networks of US defense contractors. The statement reveals that one of the two hacking groups was a China-linked cyber espionage group. ” reads the report published by FireEye. ” continues the report.

VPN

VPN Hacking Authentication Government

Cuttlefish malware targets enterprise-grade SOHO routers

Security Affairs

MAY 1, 2024

A new malware named Cuttlefish targets enterprise-grade and small office/home office (SOHO) routers to harvest public cloud authentication data. The malware creates a proxy or VPN tunnel on the compromised router to exfiltrate data, and then uses stolen credentials to access targeted resources.

Malware

Malware DNS Authentication Telecommunications

Chinese hackers used recently patched FortiOS SSL-VPN flaw as a zero-day in October

Security Affairs

JANUARY 20, 2023

An alleged Chinese threat actor was observed exploiting the recently patched CVE-2022-42475 vulnerability in FortiOS SSL-VPN. Researchers from Mandiant reported that suspected Chinese threat actors exploited the recently patched CVE-2022-42475 vulnerability in FortiOS SSL-VPN as a zero-day. firewalls, IPSIDS appliances etc.). .

VPN

VPN Firewall Internet Internet

Giving a Face to the Malware Proxy Service ‘Faceless’

Krebs on Security

APRIL 18, 2023

For the past seven years, a malware-based proxy service known as “ Faceless ” has sold anonymity to countless cybercriminals. The proxy lookup page inside the malware-based anonymity service Faceless. as a media sharing device on a local network that was somehow exposed to the Internet. Image: spur.us.

Malware

Malware Passwords Accountability Advertising

Magnet Goblin group used a new Linux variant of NerbianRAT malware

Security Affairs

MARCH 11, 2024

The financially motivated hacking group Magnet Goblin uses various 1-day flaws to deploy custom malware on Windows and Linux systems. The group focuses on internet-facing services, in at least one instance the group exploited the vulnerability CVE-2024-21887 in Ivanti Connect Secure VPN. 7 Do nothing / Idle command.

Malware

Malware VPN Encryption Hacking

Nation-state actors exploit Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus, CISA warns

Security Affairs

SEPTEMBER 8, 2023

CISA warned that nation-state actors are exploiting flaws in Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus. Cybersecurity and Infrastructure Security Agency (CISA) warned that nation-state actors are exploiting security vulnerabilities in Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus.

VPN

VPN Firewall Accountability Cybersecurity

When Low-Tech Hacks Cause High-Impact Breaches

Krebs on Security

FEBRUARY 26, 2023

Web hosting giant GoDaddy made headlines this month when it disclosed that a multi-year breach allowed intruders to steal company source code, siphon customer and employee login credentials, and foist malware on customer websites. Thus, the second factor cannot be phished, either over the phone or Internet.

Hacking

Hacking Social Engineering Phishing Scams

Ferocious Kitten APT targets Telegram and Psiphon VPN users in Iran

Security Affairs

JUNE 17, 2021

Iran-linked Ferocious Kitten APT group used instant messaging apps and VPN software like Telegram and Psiphon to deliver Windows RAT and spy on targets’ devices. Experts also spotted a tainted version of the Psiphon tool, an open-source VPN software used to evade internet censorship. SecurityAffairs – hacking, ransomware).

VPN

VPN Internet Internet Software

CISA Order Highlights Persistent Risk at Network Edge

Krebs on Security

JUNE 15, 2023

government agency in charge of improving the nation’s cybersecurity posture is ordering all federal agencies to take new measures to restrict access to Internet-exposed networking equipment. “This is reachable pre-authentication, on every SSL VPN appliance,” French vulnerability researcher Charles Fol tweeted.

Risk

Risk VPN Internet Internet

Almost 800,000 SonicWall VPN appliances online are vulnerable to CVE-2020-5135

Security Affairs

OCTOBER 16, 2020

The Tripwire VERT security team spotted almost 800,000 SonicWall VPN appliances exposed online that are vulnerable to the CVE-2020-5135 RCE flaw. Security experts from the Tripwire VERT security team have discovered 795,357 SonicWall VPN appliances that were exposed online that are vulnerable to the CVE-2020-5135 RCE flaw.

VPN

VPN Firewall Advertising Internet

Law enforcement shutdown the VPN service VPNLab used by many cybercriminal gangs

Security Affairs

JANUARY 18, 2022

Europol this week announced the shutdown of VPNLab, a VPN service that is very popular in the cybercrime ecosystem. An international operation conducted by law enforcement bodies from 10 countries took down VPNLab.net, a VPN service provider that is very popular in the cybercrime ecosystem. SecurityAffairs – hacking, VPNLab).

VPN

VPN Cybercrime Ransomware Advertising

Amadey malware spreads via software cracks laced with SmokeLoader

Security Affairs

JULY 25, 2022

Operators behind the Amadey Bot malware use the SmokeLoader to distribute a new variant via software cracks and keygen sites. Amadey Bot is a data-stealing malware that was first spotted in 2018, it also allows operators to install additional payloads. Then the malware contacts the C2 and sends system information (i.e.

Software

Software Malware Cybercrime VPN

A Deep Dive Into the Residential Proxy Service ‘911’

Krebs on Security

JULY 18, 2022

For the past seven years, an online service known as 911 has sold access to hundreds of thousands of Microsoft Windows computers daily, allowing customers to route their Internet traffic through PCs in virtually any country or city around the globe — but predominantly in the United States. THE INTERNET NEVER FORGETS.

VPN

VPN Computers and Electronics Antivirus Software

Security Affairs newsletter Round 454 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

JANUARY 13, 2024

Akira ransomware targets Finnish organizations GitLab fixed a critical zero-click account hijacking flaw Juniper Networks fixed a critical RCE bug in its firewalls and switches Vast Voter Data Leaks Cast Shadow Over Indonesia ’s 2024 Presidential Election Researchers created a PoC for Apache OFBiz flaw CVE-2023-51467 Team Liquid’s wiki leak exposes (..)

VPN

VPN Cybercrime Ransomware Hacking

DarkHotel APT uses VPN zero-day in attacks on Chinese government agencies

Security Affairs

APRIL 6, 2020

DarkHotel nation-state actor is exploiting a VPN zero -day to breach Chinese government agencies in Beijing and Shanghai. Chinese security-firm Qihoo 360 has uncovered a hacking campaign conducted by a DarkHotel APT group (APT-C-06) aimed at Chinese government agencies in Beijing and Shanghai. ” continues the researchers.

VPN

VPN Government Advertising Firmware

Experts link AVRecon bot to the malware proxy service SocksEscort

Security Affairs

JULY 31, 2023

The AVrecon malware was written in C to ensure portability and designed to target ARM-embedded devices. On infected a router, the malware enumerates the victim’s SOHO router and sends that information back to a C2 server whose address is embedded in the code. “We The popular investigator Brian Krebs and Spur.us “ SocksEscort[.]com

Malware

Malware Small Business Advertising Passwords

Expert found a secret backdoor in Zyxel firewall and VPN

Security Affairs

JANUARY 1, 2021

Impacted devices include Unified Security Gateway (USG), ATP, USG FLEX and VPN firewalls products. 2020 VPN series running firmware ZLD V4.60 They could also intercept traffic or create VPN accounts to gain access to the network behind the device. SecurityAffairs – hacking, Zyxel). Patch1 in Dec. Patch1 in Dec.

Firewall

Firewall VPN Firmware Passwords

BEST PRACTICES – 9 must-do security protocols companies must embrace to stem remote work risks

The Last Watchdog

MARCH 6, 2021

Related: Poll confirms rise of Covid 19-related hacks. Many people use a virtual private network (VPN) to bypass geographic restrictions on streaming sites or other location-specific content. Since a VPN tunnels traffic through a server in a location of your choosing. Set up firewalls. Secure home router. Back-up your data.

VPN

VPN Firewall Antivirus Passwords

China-linked Alloy Taurus APT uses a Linux variant of PingPull malware

Security Affairs

APRIL 26, 2023

PingPull, was first spotted by Unit 42 in June 2022, the researchers defined the RAT as a “difficult-to-detect” backdoor that leverages the Internet Control Message Protocol (ICMP) for C2 communications. This circumstance suggests that the threat actor is reusing existing source code to create new malware. org over port 8443 for C2.

Malware

Malware Telecommunications Government VPN

5 Ways to Protect Yourself from IP Address Hacking

Security Affairs

AUGUST 20, 2019

Your IP address represents your digital identity online, hacking it not only allows attackers to access your device or your accounts, but it may cause even bigger damage. Your IP or Internet Protocol address is your digital identity on the internet. Cybercriminals are interested in hacking your IP address for various reasons.

Hacking

Hacking VPN Internet Internet

Iran-linked APT group Pioneer Kitten sells access to hacked networks

Security Affairs

SEPTEMBER 1, 2020

Iran-linked APT group Pioneer Kitten is now trying to monetize its efforts by selling access to some of the networks it has hacked to other hackers. Iran-linked APT group Pioneer Kitten, also known as Fox Kitten or Parisite, is now trying to monetize its efforts by selling access to some of the networks it has hacked to other hackers.

Hacking

Hacking VPN Advertising Financial Services

A critical flaw in industrial automation systems opens to remote hack

Security Affairs

NOVEMBER 29, 2020

Experts found a critical flaw in Real-Time Automation’s (RTA) 499ES EtherNet/IP stack that could allow hacking industrial control systems. ” Experts used the search engines for Internet-connected devices, like Shodan.io, to search for ENIP-compatible internet-facing devices and discovered more than 8,000 systems exposed online.

Hacking

Hacking Firmware Internet Internet

9 Possible Ways Hackers Can Use Public Wi-Fi to Steal Your Sensitive Data

Security Affairs

FEBRUARY 12, 2024

Also, consider using a Virtual Private Network (VPN) to encrypt your data and make it unreadable to hackers. Invest in a VPN to encrypt your data and ensure websites you use have SSL/TSL certificates (look for “https” in the URL). Use a VPN to encrypt your internet traffic and avoid connecting to unfamiliar Wi-Fi networks.

DNS

DNS VPN Encryption Passwords

Cybersecurity During COVID-19

Schneier on Security

APRIL 7, 2020

This makes the data more likely to be hacked and stolen. If the organization is lucky, they will have already set up a VPN for remote access. Handing people VPN software to install and use with zero training is a recipe for security mistakes, but not using a VPN is even worse.

Cybersecurity

Cybersecurity VPN Scams Phishing

Widespread exploitation by botnet operators of Zyxel firewall flaw

Security Affairs

JUNE 1, 2023

Threat actors are actively exploiting a command injection flaw, tracked as CVE-2023-28771, in Zyxel firewalls to install malware. Their objective is to leverage this vulnerability to deploy and install malware on the affected systems. through 4.73, VPN series firmware versions 4.60 VPN ZLD V4.60 USG FLEX ZLD V4.60

Firewall

Firewall Firmware VPN DDOS

Someone is using SonicWall’s email security tool to hack customers

SC Magazine

APRIL 21, 2021

Together they can be used to access and read a victim’s emails, plant malware and conduct other post-compromise activities. Short for “Uncategorized Groups,” UNCs are the label FireEye gives to observed clusters of hacking activities that may (or may not) be related. million SonicWall user groups. million SonicWall user groups.

Hacking

Hacking VPN Media Firewall

CLOP Ransomware operators hacked Indian conglomerate IndiaBulls Group

Security Affairs

JUNE 23, 2020

CLOP ransomware operators have allegedly hacked IndiaBulls Group , an Indian conglomerate headquartered in Gurgaon, India. CLOP ransomware operators have allegedly hacked the Indian conglomerate IndiaBulls Group , its primary businesses are housing finance, consumer finance, and wealth management. . Pierluigi Paganini.

Hacking

Hacking Ransomware Banking Mobile

911 Proxy Service Implodes After Disclosing Breach

Krebs on Security

JULY 29, 2022

re is was one of the original “residential proxy” networks, which allow someone to rent a residential IP address to use as a relay for his/her Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web. “None of those are good replacements for LuxSocks or 911.

Cybercrime

Cybercrime Software VPN Backups

Trusted relationship attacks: trust, but verify

SecureList

MAY 28, 2024

According to 2023 statistics , only one in four affected organizations identified an incident as a result of detecting suspicious activity (launch of hacker tools, malware, network scanners, etc.) Most often, communication between the service provider and the client takes place via VPN connections and Remote Desktop Protocol (RDP) services.

VPN

VPN Accountability Passwords Antivirus

New AVrecon botnet remained under the radar for two years while targeting SOHO Routers

Security Affairs

JULY 14, 2023

A new malware dubbed AVrecon targets small office/home office (SOHO) routers, it infected over 70,000 devices from 20 countries. Lumen Black Lotus Labs uncovered a long-running hacking campaign targeting SOHO routers with a strain of malware dubbed AVrecon. ” concludes the report.

Malware

Malware Advertising Cybercrime Passwords

Russia-linked Sandworm APT compromised 11 Ukrainian telecommunications providers

Security Affairs

OCTOBER 17, 2023

Russia-linked APT group Sandworm has hacked eleven telecommunication service providers in Ukraine between since May 2023. Sandworm were observed targeting open ports and unprotected RDP or SSH interfaces to gain access to the internet-facing systems. The malware maintains persistence through Cron jobs. “Note (!) .’

Telecommunications

Telecommunications Authentication Data collection Passwords

Yevgeniy Nikulin, Russian hacker behind Dropbox and LinkedIn hacks found guilty

Security Affairs

JULY 11, 2020

A jury found Russian hacker Yevgeniy Nikulin guilty for the hack of LinkedIn, Dropbox, and Formspring back in 2012 and for the sale of the stolen data on cybercrime black marketplaces. Nikulin also hacked into an employee account of a Formspring engineer and used it to access the company network between June 13, 2012, and June 29, 2012.

Hacking

Hacking Cybercrime Data breaches Advertising

Is Your Small Business Safe Against Cyber Attacks?

CyberSecurity Insiders

MARCH 21, 2021

With a VPN like Surfshark to encrypt your online traffic and keep it protected against any security breach, your valuable data isn’t going to get compromised easily anytime soon. Anti-virus and anti-malware . Use a VPN to protect your online security and privacy. Protecting your data is very simple. Two-factor authentication .

Small Business

Small Business Cyber Attacks VPN Backups

SHARED INTEL: Coming very soon — ‘passwordless authentication’ as a de facto security practice

The Last Watchdog

NOVEMBER 11, 2020

From a business perspective, managing and resetting passwords chews up scarce resources, and yet even with the best possible maintenance passwords are trivial to hack. For most of the Internet era, we’ve learned to live with these tradeoffs. This is a type of advanced, brute-force hacking that leverages automation.

Authentication

Authentication VPN Passwords Hacking

AgeLocker ransomware operation targets QNAP NAS devices

Security Affairs

MAY 1, 2021

. “To further secure your device, do not expose your NAS to the internet. If you must connect your NAS to the internet, we highly recommend using a trusted VPN or a myQNAPcloud link.” The malware was designed to abuse NAS resources and mine cryptocurrency. SecurityAffairs – hacking, QNAP).

Ransomware

Ransomware Cryptocurrency Malware Internet

A week in security (March 29 – April 4)

Malwarebytes

APRIL 5, 2021

Last week on Malwarebytes Labs, our podcast featured Malwarebytes senior security researcher JP Taggart, who talked to us about why you need to trust your VPN. But obscuring your Internet activity—including the websites you visit, the searches you make, the files you download—doesn’t mean that a VPN magically disappears those things.

VPN

VPN Scams Internet Internet

7 Cyber Safety Tips to Outsmart Scammers

Webroot

FEBRUARY 26, 2024

They come in all shapes and sizes, lurking in the shadowy corners of the internet. You can also be a good internet citizen by forwarding these scams to the U.S. That’s where a virtual private network (VPN) swoops in like a digital superhero to save the day. Let’s embrace the golden rule of scam detection: skepticism.

Scams

Scams VPN Passwords Phishing

Security Affairs newsletter Round 402 by Pierluigi Paganini

Security Affairs

JANUARY 15, 2023

Most internet-exposed Cacti servers exposed to hacking French CNIL fined Tiktok $5.4 Most internet-exposed Cacti servers exposed to hacking French CNIL fined Tiktok $5.4 Most internet-exposed Cacti servers exposed to hacking French CNIL fined Tiktok $5.4 SecurityAffairs – hacking, newsletter).

Small Business

Small Business Password Management VPN Healthcare

CISA says federal agency compromised by malicious cyber actor

Security Affairs

SEPTEMBER 25, 2020

CISA published a detailed incident report related to the incident but didn’t disclose the name of the hacked agency. Threat actors implanted a malware in the network of an unnamed federal agency that was able to avoid detection. ” reads the analysis report published by CISA. ” continues the report.

VPN

VPN Malware Cyber threats Accountability

Does Your Organization Have a Security.txt File?

Krebs on Security

SEPTEMBER 20, 2021

It happens all the time: Organizations get hacked because there isn’t an obvious way for security researchers to let them know about security vulnerabilities or data leaks. An example of a security.txt file. Image: Securitytxt.org. well-known/security.txt. I still have no idea if anyone has read it. ” GET READY TO BE DELUGED.

Retail

Retail Healthcare Internet Internet

A new Zerobot variant spreads by exploiting Apache flaws

Security Affairs

DECEMBER 22, 2022

Microsoft Threat Intelligence Center (MSTIC) researchers discovered a new variant of the Zerobot botnet (aka ZeroStresser) that was improved with the capabilities to target more Internet of Things (IoT) devices. Zerobot operators are offering the botnet as a malware-as-a-service model, one domain (zerostresser[.]com)

IoT

IoT DDOS Malware Firmware

Russian internet watchdog Roskomnadzor bans six more VPN services

Who and What is Behind the Malware Proxy Service SocksEscort?

Trending Sources

Treasury Sanctions Creators of 911 S5 Proxy Botnet

China-linked APT used Pulse Secure VPN zero-day to hack US defense contractors

Cuttlefish malware targets enterprise-grade SOHO routers

Chinese hackers used recently patched FortiOS SSL-VPN flaw as a zero-day in October

Giving a Face to the Malware Proxy Service ‘Faceless’

Magnet Goblin group used a new Linux variant of NerbianRAT malware

Nation-state actors exploit Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus, CISA warns

When Low-Tech Hacks Cause High-Impact Breaches

Ferocious Kitten APT targets Telegram and Psiphon VPN users in Iran

CISA Order Highlights Persistent Risk at Network Edge

Almost 800,000 SonicWall VPN appliances online are vulnerable to CVE-2020-5135

Law enforcement shutdown the VPN service VPNLab used by many cybercriminal gangs

Amadey malware spreads via software cracks laced with SmokeLoader

A Deep Dive Into the Residential Proxy Service ‘911’

Security Affairs newsletter Round 454 by Pierluigi Paganini – INTERNATIONAL EDITION

DarkHotel APT uses VPN zero-day in attacks on Chinese government agencies

Experts link AVRecon bot to the malware proxy service SocksEscort

Expert found a secret backdoor in Zyxel firewall and VPN

BEST PRACTICES – 9 must-do security protocols companies must embrace to stem remote work risks

China-linked Alloy Taurus APT uses a Linux variant of PingPull malware

5 Ways to Protect Yourself from IP Address Hacking

Iran-linked APT group Pioneer Kitten sells access to hacked networks

A critical flaw in industrial automation systems opens to remote hack

9 Possible Ways Hackers Can Use Public Wi-Fi to Steal Your Sensitive Data

Cybersecurity During COVID-19

Widespread exploitation by botnet operators of Zyxel firewall flaw

Someone is using SonicWall’s email security tool to hack customers

CLOP Ransomware operators hacked Indian conglomerate IndiaBulls Group

911 Proxy Service Implodes After Disclosing Breach

Trusted relationship attacks: trust, but verify

New AVrecon botnet remained under the radar for two years while targeting SOHO Routers

Russia-linked Sandworm APT compromised 11 Ukrainian telecommunications providers

Yevgeniy Nikulin, Russian hacker behind Dropbox and LinkedIn hacks found guilty

Is Your Small Business Safe Against Cyber Attacks?

SHARED INTEL: Coming very soon — ‘passwordless authentication’ as a de facto security practice

AgeLocker ransomware operation targets QNAP NAS devices

A week in security (March 29 – April 4)

7 Cyber Safety Tips to Outsmart Scammers

Security Affairs newsletter Round 402 by Pierluigi Paganini

CISA says federal agency compromised by malicious cyber actor

Does Your Organization Have a Security.txt File?

A new Zerobot variant spreads by exploiting Apache flaws

Stay Connected