backdoor - Security Ticks

Major Backdoor in Millions of RFID Cards Allows Instant Cloning

backdoor, China, Featured, IoT Security, RFID, Vulnerabilities / SecurityTicks

Major Backdoor in Millions of RFID Cards Allows Instant Cloning 2024-08-20 at 21:31 By Ryan Naraine Backdoor in millions of contactless cards made by Shanghai Fudan Microelectronics allows instantaneous cloning of RFID smart cards used to open office doors and hotel rooms around the world. The post Major Backdoor in Millions of RFID Cards Allows […]

React to this headline:

Major Backdoor in Millions of RFID Cards Allows Instant Cloning Read More »

FIN7 sells improved EDR killer tool

attack tools, backdoor, cybercrime, cybercriminals, Don't miss, Hot stuff, Malware, News, Ransomware, SentinelOne / SecurityTicks

FIN7 sells improved EDR killer tool 2024-07-18 at 15:46 By Zeljka Zorz The cybercrime-focused enterprise known as FIN7 (aka the Carbanak group) has come up with yet another trick to assure the effectiveness of its “EDR killer” tool, dubbed AvNeutralizer (i.e., AuKill) by researchers. By leveraging Windows’ built-in driver TTD Monitor Driver (ProcLaunchMon.sys), in conjunction

React to this headline:

FIN7 sells improved EDR killer tool Read More »

Compromised plugins found on WordPress.org

backdoor, Don't miss, Hot stuff, News, plugin, supply chain compromise, Wordfence, WordPress / SecurityTicks

Compromised plugins found on WordPress.org 2024-06-26 at 11:46 By Zeljka Zorz An unknown threat actor has compromised five (and possibly more) WordPress plugins and injected them with code that creates a new admin account, effectively allowing them complete control over WordPress installations / websites. “In addition, it appears the threat actor also injected malicious JavaScript

React to this headline:

Compromised plugins found on WordPress.org Read More »

New BadSpace Backdoor Deployed in Drive-By Attacks

backdoor, Malware, Malware & Threats / SecurityTicks

New BadSpace Backdoor Deployed in Drive-By Attacks 2024-06-18 at 19:45 By Ionut Arghire The BadSpace backdoor is being distributed via drive-by attacks involving infected websites and JavaScript downloaders. The post New BadSpace Backdoor Deployed in Drive-By Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source React to

React to this headline:

New BadSpace Backdoor Deployed in Drive-By Attacks Read More »

‘NsaRescueAngel’ Backdoor Account Again Discovered in Zyxel Products

backdoor, NAS, Vulnerabilities, Zyxel / SecurityTicks

‘NsaRescueAngel’ Backdoor Account Again Discovered in Zyxel Products 2024-06-05 at 15:03 By Ionut Arghire Critical vulnerabilities in discontinued Zyxel NAS products allow unauthenticated attackers to execute arbitrary code and OS commands. The post ‘NsaRescueAngel’ Backdoor Account Again Discovered in Zyxel Products appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View

React to this headline:

‘NsaRescueAngel’ Backdoor Account Again Discovered in Zyxel Products Read More »

Ebury botnet compromises 400,000+ Linux servers

backdoor, botnet, cybercrime, Don't miss, ESET, Linux, Malware, News / SecurityTicks

Ebury botnet compromises 400,000+ Linux servers 2024-05-16 at 07:31 By Help Net Security ESET researchers released its deep-dive investigation into one of the most advanced server-side malware campaigns. It is still growing and has seen hundreds of thousands of compromised servers in its at least 15-year-long operation. The Ebury group and botnet have been involved

React to this headline:

Ebury botnet compromises 400,000+ Linux servers Read More »

MITRE breach details reveal attackers’ successes and failures

APT, backdoor, data breach, Don't miss, government-backed attacks, Hot stuff, Ivanti, Mandiant, MITRE, News, reconnaissance, Volexity, web shell / SecurityTicks

MITRE breach details reveal attackers’ successes and failures 2024-05-08 at 14:16 By Zeljka Zorz MITRE has shared a timeline of the recent breach if fell victim to and has confirmed that it began earlier than previously thought: on December 31, 2023. On that day, the attackers deployed a web shell on an external-facing Ivanti Connect

React to this headline:

MITRE breach details reveal attackers’ successes and failures Read More »

New open-source project takeover attacks spotted, stymied

backdoor, CISA, Don't miss, Endor Labs, Hot stuff, News, O'Reilly, open source, OpenJS Foundation, OpenSSF, social engineering, supply chain attacks, tips / SecurityTicks

New open-source project takeover attacks spotted, stymied 2024-04-16 at 16:16 By Zeljka Zorz The OpenJS Foundation has headed off a “credible takeover attempt” similar to the one that resulted in a backdoor getting included in the open-source XZ Utils package by someone who called themselves “Jia Tan”. This malicious maintainer achieved that coveted position after

React to this headline:

New open-source project takeover attacks spotted, stymied Read More »

XZ Utils backdoor: Detection tools, scripts, rules

backdoor, Binarly, Bitdefender, Don't miss, Elastic, GitHub, Hot stuff, Linux, News, open source, supply chain compromise / SecurityTicks

XZ Utils backdoor: Detection tools, scripts, rules 2024-04-08 at 16:31 By Zeljka Zorz As the analysis of the backdoor in XZ Utils continues, several security companies have provided tools and advice on how to detect its presence on Linux systems. What happened? The open-source XZ Utils compression utility has been backdoored by a skilled threat

React to this headline:

XZ Utils backdoor: Detection tools, scripts, rules Read More »

Magento Vulnerability Exploited to Deploy Persistent Backdoor

backdoor, ecommerce, Malware & Threats / SecurityTicks

Magento Vulnerability Exploited to Deploy Persistent Backdoor 2024-04-05 at 14:16 By Ionut Arghire Attackers are exploiting a recent Magento vulnerability to deploy a persistent backdoor on ecommerce websites. The post Magento Vulnerability Exploited to Deploy Persistent Backdoor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source React to

React to this headline:

Magento Vulnerability Exploited to Deploy Persistent Backdoor Read More »

XZ Utils backdoor update: Which Linux distros are affected and what can you do?

Alpine, backdoor, Debian, Don't miss, Fedora, Hot stuff, Kali Linux, Linux, Linux Mint, News, open source, Orca Security, Red Hat, supply chain attacks, Ubuntu, vulnerability / SecurityTicks

XZ Utils backdoor update: Which Linux distros are affected and what can you do? 2024-03-31 at 21:01 By Zeljka Zorz The news that XZ Utils, a compression utility present in most Linux distributions, has been backdoored by a supposedly trusted maintainer has rattled the open-source software community on Friday, mere hours until the beginning of

React to this headline:

XZ Utils backdoor update: Which Linux distros are affected and what can you do? Read More »

Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)

backdoor, CISA, CVE, Debian, Don't miss, Fedora, Hot stuff, Linux, News, open source, Red Hat, SUSE, vulnerability / SecurityTicks

Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094) 2024-03-29 at 20:31 By Zeljka Zorz A vulnerability (CVE-2024-3094) in XZ Utils, the XZ format compression utilities included in most Linux distributions, may “enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely,” Red Hat warns.

React to this headline:

Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094) Read More »

Hackers leverage 1-day vulnerabilities to deliver custom Linux malware

backdoor, Check Point, Don't miss, exploit, Hot stuff, Linux, Malware, News, vulnerability, Windows / SecurityTicks

Hackers leverage 1-day vulnerabilities to deliver custom Linux malware 2024-03-12 at 11:01 By Helga Labus A financially motivated threat actor is using known vulnerabilities to target public-facing services and deliver custom malware to unpatched Windows and Linux systems. Among the exploited vulnerabilities are also two recently discovered Ivanti Connect Secure VPN flaws that are widely

React to this headline:

Hackers leverage 1-day vulnerabilities to deliver custom Linux malware Read More »

Russian Turla Cyberspies Target Polish NGOs With New Backdoor

backdoor, Malware, Malware & Threats, Nation-State, Russia, Turla / SecurityTicks

Russian Turla Cyberspies Target Polish NGOs With New Backdoor 2024-02-22 at 18:01 By Ionut Arghire Russian state-sponsored threat actor Turla has been using a new backdoor in recent attacks targeting Polish NGOs. The post Russian Turla Cyberspies Target Polish NGOs With New Backdoor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS

React to this headline:

Russian Turla Cyberspies Target Polish NGOs With New Backdoor Read More »

Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor

backdoor, exploited, Ivanti, Malware & Threats / SecurityTicks

Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor 2024-02-13 at 15:31 By Ionut Arghire Backdoor deployed using recent Ivanti VPN vulnerability enables command execution, web request and system log theft. The post Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original

React to this headline:

Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor Read More »

Attackers injected novel DSLog backdoor into 670 vulnerable Ivanti devices (CVE-2024-21893)

backdoor, Don't miss, exploit, Hot stuff, Ivanti, News, Orange Cyberdefense, vulnerability / SecurityTicks

Attackers injected novel DSLog backdoor into 670 vulnerable Ivanti devices (CVE-2024-21893) 2024-02-13 at 13:01 By Helga Labus Hackers are actively exploiting a vulnerability (CVE-2024-21893) in Ivanti Connect Secure, Policy Secure and Neurons for ZTA to inject a “previously unknown and interesting backdoor” dubbed DSLog. CVE-2024-21893 patches and exploitation Ivanti disclosed CVE-2024-21893 – a server-side request

React to this headline:

Attackers injected novel DSLog backdoor into 670 vulnerable Ivanti devices (CVE-2024-21893) Read More »

Blackwood APT delivers malware by hijacking legitimate software update requests

backdoor, China, cyber espionage, Don't miss, ESET, hijacking, Japan, Malware, MITM, News, UK / SecurityTicks

Blackwood APT delivers malware by hijacking legitimate software update requests 2024-01-25 at 13:32 By Help Net Security ESET researchers have discovered NSPX30, a sophisticated implant used by a new China-aligned APT group, which they dubbed Blackwood. Blackwood has carried out cyberespionage operations against individuals and companies from China, Japan, and the United Kingdom. It leverages

React to this headline:

Blackwood APT delivers malware by hijacking legitimate software update requests Read More »

Ivanti Connect Secure zero-days exploited by attackers (CVE-2023-46805, CVE-2024-21887)

0-day, APT, backdoor, Don't miss, enterprise, Hot stuff, Ivanti, News, Volexity, VPN, web shell / SecurityTicks

Ivanti Connect Secure zero-days exploited by attackers (CVE-2023-46805, CVE-2024-21887) 2024-01-11 at 13:46 By Zeljka Zorz Two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) in Ivanti Connect Secure VPN devices are under active exploitation by unknown attackers, Volexity researchers have discovered. Patches for these flaws are currently unavailable, but the risk of exploitation can be mitigated by importing mitigation.release.20240107.1.xml

React to this headline:

Ivanti Connect Secure zero-days exploited by attackers (CVE-2023-46805, CVE-2024-21887) Read More »

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day

0-day, attack, backdoor, Cisco, Don't miss, Hot stuff, News, Orange Cyberdefense, security update / SecurityTicks

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day 23/10/2023 at 13:04 By Zeljka Zorz Cisco has released the first fixes for the IOS XE zero-day (CVE-2023-20198) exploited by attackers to ultimately deliver a malicious implant. The fixes were made available on Sunday, but a curious thing happened the day before: several

React to this headline:

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day Read More »

Quantum risk is real now: How to navigate the evolving data harvesting threat

Artificial Intelligence, backdoor, cybersecurity, data security, Don't miss, Expert analysis, Expert corner, firmware, Hot stuff, machine learning, News, opinion, Qrypt, threat / SecurityTicks

Quantum risk is real now: How to navigate the evolving data harvesting threat 13/10/2023 at 07:32 By Help Net Security In an era where data security is paramount, the recent revelations about firmware backdoors implanted by Chinese government-backed hackers serve as a stark reminder of the evolving threat landscape. BlackTech is infiltrating routers to gain

React to this headline:

Quantum risk is real now: How to navigate the evolving data harvesting threat Read More »