DDoS Botnets Hijacking Zyxel Devices to Launch Devastating Attacks

DDoS Botnets Hijacking Zyxel Devices to Launch Devastating Attacks,

Several distributed denial-of-service (DDoS) botnets have been observed exploiting a critical flaw in Zyxel devices that came to light in April 2023 to gain remote control of vulnerable systems.
« Through the capture of exploit traffic, the attacker’s IP address was identified, and it was determined that the attacks were occurring in multiple regions, including Central America, North America,

,

Several distributed denial-of-service (DDoS) botnets have been observed exploiting a critical flaw in Zyxel devices that came to light in April 2023 to gain remote control of vulnerable systems.
« Through the capture of exploit traffic, the attacker’s IP address was identified, and it was determined that the attacks were occurring in multiple regions, including Central America, North America,

, ,
https://thehackernews.com/2023/07/ddos-botnets-hijacking-zyxel-devices-to.html

Citrix NetScaler ADC and Gateway Devices Under Attack: CISA Urges Immediate Action

Citrix NetScaler ADC and Gateway Devices Under Attack: CISA Urges Immediate Action,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on Thursday warning that the newly disclosed critical security flaw in Citrix NetScaler Application Delivery Controller (ADC) and Gateway devices is being abused to drop web shells on vulnerable systems.
« In June 2023, threat actors exploited this vulnerability as a zero-day to drop a web shell on a critical

,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on Thursday warning that the newly disclosed critical security flaw in Citrix NetScaler Application Delivery Controller (ADC) and Gateway devices is being abused to drop web shells on vulnerable systems.
« In June 2023, threat actors exploited this vulnerability as a zero-day to drop a web shell on a critical

, ,
https://thehackernews.com/2023/07/citrix-netscaler-adc-and-gateway.html

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks,

Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal.
« Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an organization’s files, and then threatening to publish the stolen data on a leak site as leverage to convince

,

Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal.
« Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an organization’s files, and then threatening to publish the stolen data on a leak site as leverage to convince

, ,
https://thehackernews.com/2023/07/mallox-ransomware-exploits-weak-ms-sql.html

Critical Flaws in AMI MegaRAC BMC Software Expose Servers to Remote Attacks

Critical Flaws in AMI MegaRAC BMC Software Expose Servers to Remote Attacks,

Two more security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software that, if successfully exploited, could allow threat actors to remotely commandeer vulnerable servers and deploy malware.
« These new vulnerabilities range in severity from High to Critical, including unauthenticated remote code execution and unauthorized device access with superuser

,

Two more security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software that, if successfully exploited, could allow threat actors to remotely commandeer vulnerable servers and deploy malware.
« These new vulnerabilities range in severity from High to Critical, including unauthenticated remote code execution and unauthorized device access with superuser

, ,
https://thehackernews.com/2023/07/critical-flaws-in-ami-megarac-bmc.html

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks

Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks,

Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal.
« Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an organization’s files, and then threatening to publish the stolen data on a leak site as leverage to convince

,

Mallox ransomware activities in 2023 have witnessed a 174% increase when compared to the previous year, new findings from Palo Alto Networks Unit 42 reveal.
« Mallox ransomware, like many other ransomware threat actors, follows the double extortion trend: stealing data before encrypting an organization’s files, and then threatening to publish the stolen data on a leak site as leverage to convince

, ,
https://thehackernews.com/2023/07/mallox-ransomware-exploits-weak-ms-sql.html

Apache OpenMeetings Web Conferencing Tool Exposed to Critical Vulnerabilities

Apache OpenMeetings Web Conferencing Tool Exposed to Critical Vulnerabilities,

Multiple security flaws have been disclosed in Apache OpenMeetings, a web conferencing solution, that could be potentially exploited by malicious actors to seize control of admin accounts and run malicious code on susceptible servers.
« Attackers can bring the application into an unexpected state, which allows them to take over any user account, including the admin account, » Sonar vulnerability

,

Multiple security flaws have been disclosed in Apache OpenMeetings, a web conferencing solution, that could be potentially exploited by malicious actors to seize control of admin accounts and run malicious code on susceptible servers.
« Attackers can bring the application into an unexpected state, which allows them to take over any user account, including the admin account, » Sonar vulnerability

, ,
https://thehackernews.com/2023/07/apache-openmeetings-web-conferencing.html

North Korean State-Sponsored Hackers Suspected in JumpCloud Supply Chain Attack

North Korean State-Sponsored Hackers Suspected in JumpCloud Supply Chain Attack,

An analysis of the indicators of compromise (IoCs) associated with the JumpCloud hack has uncovered evidence pointing to the involvement of North Korean state-sponsored groups, in a style that’s reminiscent of the supply chain attack targeting 3CX.
The findings come from SentinelOne, which mapped out the infrastructure pertaining to the intrusion to uncover underlying patterns. It’s worth noting

,

An analysis of the indicators of compromise (IoCs) associated with the JumpCloud hack has uncovered evidence pointing to the involvement of North Korean state-sponsored groups, in a style that’s reminiscent of the supply chain attack targeting 3CX.
The findings come from SentinelOne, which mapped out the infrastructure pertaining to the intrusion to uncover underlying patterns. It’s worth noting

, ,
https://thehackernews.com/2023/07/north-korean-state-sponsored-hackers.html

A Few More Reasons Why RDP is Insecure (Surprise!)

A Few More Reasons Why RDP is Insecure (Surprise!),

If it seems like Remote Desktop Protocol (RDP) has been around forever, it’s because it has (at least compared to the many technologies that rise and fall within just a few years.) The initial version, known as « Remote Desktop Protocol 4.0, » was released in 1996 as part of the Windows NT 4.0 Terminal Server edition and allowed users to remotely access and control Windows-based computers over a

,

If it seems like Remote Desktop Protocol (RDP) has been around forever, it’s because it has (at least compared to the many technologies that rise and fall within just a few years.) The initial version, known as « Remote Desktop Protocol 4.0, » was released in 1996 as part of the Windows NT 4.0 Terminal Server edition and allowed users to remotely access and control Windows-based computers over a

, ,
https://thehackernews.com/2023/07/a-few-more-reasons-why-rdp-is-insecure.html

Turla’s New DeliveryCheck Backdoor Breaches Ukrainian Defense Sector

Turla’s New DeliveryCheck Backdoor Breaches Ukrainian Defense Sector

,

The defense sector in Ukraine and Eastern Europe has been targeted by a novel .NET-based backdoor called DeliveryCheck (aka CAPIBAR or GAMEDAY) that’s capable of delivering next-stage payloads.
The Microsoft threat intelligence team, in collaboration with the Computer Emergency Response Team of Ukraine (CERT-UA), attributed the attacks to a Russian nation-state actor known as Turla, which is

,

The defense sector in Ukraine and Eastern Europe has been targeted by a novel .NET-based backdoor called DeliveryCheck (aka CAPIBAR or GAMEDAY) that’s capable of delivering next-stage payloads.
The Microsoft threat intelligence team, in collaboration with the Computer Emergency Response Team of Ukraine (CERT-UA), attributed the attacks to a Russian nation-state actor known as Turla, which is

, ,
https://thehackernews.com/2023/07/turlas-new-deliverycheck-backdoor.html

New P2PInfect Worm Targeting Redis Servers on Linux and Windows Systems

New P2PInfect Worm Targeting Redis Servers on Linux and Windows Systems,

Cybersecurity researchers have uncovered a new cloud targeting, peer-to-peer (P2P) worm called P2PInfect that targets vulnerable Redis instances for follow-on exploitation.
« P2PInfect exploits Redis servers running on both Linux and Windows Operating Systems making it more scalable and potent than other worms, » Palo Alto Networks Unit 42 researchers William Gamazo and Nathaniel Quist said. « This

,

Cybersecurity researchers have uncovered a new cloud targeting, peer-to-peer (P2P) worm called P2PInfect that targets vulnerable Redis instances for follow-on exploitation.
« P2PInfect exploits Redis servers running on both Linux and Windows Operating Systems making it more scalable and potent than other worms, » Palo Alto Networks Unit 42 researchers William Gamazo and Nathaniel Quist said. « This

, ,
https://thehackernews.com/2023/07/new-p2pinfect-worm-targeting-redis.html