Ebury botnet compromises 400,000+ Linux servers 2024-05-16 at 07:31 By Help Net Security ESET researchers released its deep-dive investigation into one of the most advanced server-side malware campaigns. It is still growing and has seen hundreds of thousands of compromised servers in its at least 15-year-long operation. The Ebury group and botnet have been involved […]
Ebury botnet compromises 400,000+ Linux servers Read More »
MITRE breach details reveal attackers’ successes and failures 2024-05-08 at 14:16 By Zeljka Zorz MITRE has shared a timeline of the recent breach if fell victim to and has confirmed that it began earlier than previously thought: on December 31, 2023. On that day, the attackers deployed a web shell on an external-facing Ivanti Connect
MITRE breach details reveal attackers’ successes and failures Read More »
New open-source project takeover attacks spotted, stymied 2024-04-16 at 16:16 By Zeljka Zorz The OpenJS Foundation has headed off a “credible takeover attempt” similar to the one that resulted in a backdoor getting included in the open-source XZ Utils package by someone who called themselves “Jia Tan”. This malicious maintainer achieved that coveted position after
New open-source project takeover attacks spotted, stymied Read More »
XZ Utils backdoor: Detection tools, scripts, rules 2024-04-08 at 16:31 By Zeljka Zorz As the analysis of the backdoor in XZ Utils continues, several security companies have provided tools and advice on how to detect its presence on Linux systems. What happened? The open-source XZ Utils compression utility has been backdoored by a skilled threat
XZ Utils backdoor: Detection tools, scripts, rules Read More »
Magento Vulnerability Exploited to Deploy Persistent Backdoor 2024-04-05 at 14:16 By Ionut Arghire Attackers are exploiting a recent Magento vulnerability to deploy a persistent backdoor on ecommerce websites. The post Magento Vulnerability Exploited to Deploy Persistent Backdoor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original Source
Magento Vulnerability Exploited to Deploy Persistent Backdoor Read More »
XZ Utils backdoor update: Which Linux distros are affected and what can you do? 2024-03-31 at 21:01 By Zeljka Zorz The news that XZ Utils, a compression utility present in most Linux distributions, has been backdoored by a supposedly trusted maintainer has rattled the open-source software community on Friday, mere hours until the beginning of
XZ Utils backdoor update: Which Linux distros are affected and what can you do? Read More »
Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094) 2024-03-29 at 20:31 By Zeljka Zorz A vulnerability (CVE-2024-3094) in XZ Utils, the XZ format compression utilities included in most Linux distributions, may “enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely,” Red Hat warns.
Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094) Read More »
Hackers leverage 1-day vulnerabilities to deliver custom Linux malware 2024-03-12 at 11:01 By Helga Labus A financially motivated threat actor is using known vulnerabilities to target public-facing services and deliver custom malware to unpatched Windows and Linux systems. Among the exploited vulnerabilities are also two recently discovered Ivanti Connect Secure VPN flaws that are widely
Hackers leverage 1-day vulnerabilities to deliver custom Linux malware Read More »
Russian Turla Cyberspies Target Polish NGOs With New Backdoor 2024-02-22 at 18:01 By Ionut Arghire Russian state-sponsored threat actor Turla has been using a new backdoor in recent attacks targeting Polish NGOs. The post Russian Turla Cyberspies Target Polish NGOs With New Backdoor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS
Russian Turla Cyberspies Target Polish NGOs With New Backdoor Read More »
Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor 2024-02-13 at 15:31 By Ionut Arghire Backdoor deployed using recent Ivanti VPN vulnerability enables command execution, web request and system log theft. The post Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor appeared first on SecurityWeek. This article is an excerpt from SecurityWeek RSS Feed View Original
Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor Read More »
Attackers injected novel DSLog backdoor into 670 vulnerable Ivanti devices (CVE-2024-21893) 2024-02-13 at 13:01 By Helga Labus Hackers are actively exploiting a vulnerability (CVE-2024-21893) in Ivanti Connect Secure, Policy Secure and Neurons for ZTA to inject a “previously unknown and interesting backdoor” dubbed DSLog. CVE-2024-21893 patches and exploitation Ivanti disclosed CVE-2024-21893 – a server-side request
Blackwood APT delivers malware by hijacking legitimate software update requests 2024-01-25 at 13:32 By Help Net Security ESET researchers have discovered NSPX30, a sophisticated implant used by a new China-aligned APT group, which they dubbed Blackwood. Blackwood has carried out cyberespionage operations against individuals and companies from China, Japan, and the United Kingdom. It leverages
Blackwood APT delivers malware by hijacking legitimate software update requests Read More »
Ivanti Connect Secure zero-days exploited by attackers (CVE-2023-46805, CVE-2024-21887) 2024-01-11 at 13:46 By Zeljka Zorz Two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) in Ivanti Connect Secure VPN devices are under active exploitation by unknown attackers, Volexity researchers have discovered. Patches for these flaws are currently unavailable, but the risk of exploitation can be mitigated by importing mitigation.release.20240107.1.xml
Ivanti Connect Secure zero-days exploited by attackers (CVE-2023-46805, CVE-2024-21887) Read More »
“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day 23/10/2023 at 13:04 By Zeljka Zorz Cisco has released the first fixes for the IOS XE zero-day (CVE-2023-20198) exploited by attackers to ultimately deliver a malicious implant. The fixes were made available on Sunday, but a curious thing happened the day before: several
“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day Read More »
Quantum risk is real now: How to navigate the evolving data harvesting threat 13/10/2023 at 07:32 By Help Net Security In an era where data security is paramount, the recent revelations about firmware backdoors implanted by Chinese government-backed hackers serve as a stark reminder of the evolving threat landscape. BlackTech is infiltrating routers to gain
Quantum risk is real now: How to navigate the evolving data harvesting threat Read More »
Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin 12/10/2023 at 17:50 By Ionut Arghire A backdoor deployed on a compromised WordPress website poses as a legitimate plugin to hide its presence. The post Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin appeared first on SecurityWeek. This article is an excerpt from
Backdoor Malware Found on WordPress Website Disguised as Legitimate Plugin Read More »
Android Devices With Backdoored Firmware Found in US Schools 06/10/2023 at 18:03 By Ionut Arghire A global cybercriminal operation called BadBox has infected the firmware of more than 70,000 Android smartphones, CTV boxes, and tablets with the Triada malware. The post Android Devices With Backdoored Firmware Found in US Schools appeared first on SecurityWeek. This
Android Devices With Backdoored Firmware Found in US Schools Read More »
Are executives adequately guarding their gadgets? 06/10/2023 at 07:02 By Help Net Security Today, individual citizens, rather than businesses or governmental bodies, are the main entry points for cyberattacks. However, security solutions haven’t evolved sufficiently to guard public figures and leaders as they do for large corporate entities. In this Help Net Security video, Amir
Are executives adequately guarding their gadgets? Read More »
Backdoored Android phones, TVs used for ad fraud – and worse! 04/10/2023 at 19:46 By Help Net Security A key monetization mechanism of a sophisticated series of cybercriminal operations involving backdoored off-brand mobile and CTV Android devices has been disrupted, Human Security has announced. The company’s Satori Threat Intelligence and Research Team observed more than
Backdoored Android phones, TVs used for ad fraud – and worse! Read More »
Lazarus impersonated Meta recruiter to breach Spanish aerospace firm 02/10/2023 at 11:48 By Help Net Security Operators of the North Korea-linked Lazarus APT obtained initial access to the network of an aerospace company in Spain last year after a successful spearphishing campaign, by masquerading as a recruiter for Meta — the company behind Facebook, Instagram,
Lazarus impersonated Meta recruiter to breach Spanish aerospace firm Read More »