Tag: PASSWORD

Beware of Contacts through LinkedIn: They Target Your Organization’s Property, Not Yours – JPCERT/CC Eyes | JPCERT Coordination Center official Blog
Recent reports indicate unauthorized access in Japan, primarily using LinkedIn as an infection vector. The Lazarus attack group has been identified as responsible for these attacks, which have targeted organizations since 2019. Recommendations include restricting the use of social networking services on work devices. Affected: LinkedIn, Bitcoin.DMM.com…
Read More
Analysis Report on the Latest Phishing Incident by Clickfix: The Tragedy of CAPTCHA Resistance – Security Cow
This article analyzes the Clickfix phishing incidents, highlighting the evolution of CAPTCHA bypass techniques and the exploitation of user trust in verification mechanisms. It details how attackers use social engineering to manipulate users into executing malicious commands, leading to data theft. Affected: Windows system users, WordPress websites, online security sector

Keypoints :

Clickfix is a phishing technique that exploits user fatigue with verification processes.…
Read More
If you think you blocked NTLMv1 in your org, think again
Silverfort has uncovered a significant misconfiguration in Active Directory Group Policy that allows NTLMv1 authentications to persist despite attempts to disable it. This flaw poses a security risk for organizations using on-prem applications, as attackers can exploit this vulnerability to gain unauthorized access. Affected: Active Directory, NTLMv1

Keypoints :

Silverfort’s research reveals a misconfiguration in Group Policy that allows NTLMv1 authentications to continue.…
Read More
Private Keys in the Fortigate Leak – Hanno’s blog
Summary: Recently, a leak of configuration files for Fortigate/Fortinet devices revealed sensitive data, including TLS and SSH private keys, due to a known vulnerability (CVE-2022-40684). Despite previous warnings from Fortinet about active exploitation, many users failed to change their default passwords, leaving their systems vulnerable. The incident highlights ongoing issues with security practices and the effectiveness of security advisories.…
Read More
IoT Botnet Linked to Large-scale DDoS Attacks Since the End of 2024
This article discusses the ongoing large-scale DDoS attacks orchestrated by an IoT botnet that exploits vulnerable devices, primarily targeting companies in Japan and other countries. The botnet utilizes malware derived from Mirai and Bashlite, affecting various sectors and employing multiple DDoS attack methods. Affected: Japan, North America, Europe

Keypoints :

Large-scale DDoS attacks monitored since the end of 2024.…
Read More
Critical Vulnerability Threatens STEALTHONE Network Storage Servers
Summary: JPCERT/CC has issued a warning about critical vulnerabilities in STEALTHONE D220, D340, and D440 network storage servers, urging immediate firmware updates. The vulnerabilities, identified as CVE-2025-20016, CVE-2025-20055, and CVE-2025-20620, could allow attackers to execute arbitrary commands, gain unauthorized access, and steal administrative passwords. Users are advised to update their devices to the latest firmware to mitigate these risks.…
Read More
New Star Blizzard spear-phishing campaign targets WhatsApp accounts | Microsoft Security Blog
In mid-November 2024, Microsoft Threat Intelligence reported a shift in tactics by the Russian threat actor Star Blizzard, who began targeting WhatsApp accounts through spear-phishing campaigns. This new approach involves impersonating US government officials to lure victims into malicious links that compromise their WhatsApp data. The campaign highlights the actor’s resilience and adaptability in the face of operational disruptions.…
Read More
Threat Bulletin: Weaponized Software Targets Chinese-Speaking Organizations
A series of sophisticated cyberattacks targeting organizations in Chinese-speaking regions have been identified, utilizing a multi-stage loader called PNGPlug to deliver the ValleyRAT malware. The attacks begin with phishing tactics, leading to the installation of a malicious MSI package that deploys the malware while maintaining a facade of legitimacy.…
Read More
How to Bring Zero Trust to Wi-Fi Security with a Cloud-based Captive Portal?
Summary: Recent data breaches have underscored the urgent need for enhanced security in guest Wi-Fi infrastructures across organizations. As businesses strive to balance network protection with convenient access for guests and employees, implementing secure guest Wi-Fi solutions has become essential. The integration of zero-trust architecture with cloud-based captive portals offers a robust framework for safeguarding sensitive data while ensuring compliance and operational continuity.…
Read More
Industry Reactions to Biden’s Cybersecurity Executive Order: Feedback Friday
Summary: President Joe Biden’s recent executive order aims to enhance U.S. cybersecurity by addressing various critical areas, including software supply chains, encryption, and foreign threats. The order has sparked discussions among cybersecurity professionals regarding its future under the incoming Trump administration. Experts express both optimism and concern about the implications of the order for national security and the cybersecurity landscape.…
Read More
Vulnerabilities in SimpleHelp Remote Access Software May Lead to System Compromise
Summary: Vulnerabilities in the SimpleHelp remote access software can be easily exploited, allowing attackers to compromise both server and client machines. Key issues include a path traversal vulnerability and improper privilege escalation, which could lead to unauthorized access and remote code execution. SimpleHelp has released patches to address these vulnerabilities, urging users to update their installations promptly.…
Read More
Gootloader inside out
The Gootloader malware employs sophisticated social engineering tactics to infect users through compromised WordPress sites. It manipulates search engine results to direct victims to these sites, where they encounter fake message boards that link to the malware. The infection process is complex and heavily obfuscated, making it difficult for even site owners to detect.…
Read More
FTC sues GoDaddy for years of poor hosting security practices
Summary: The Federal Trade Commission (FTC) has mandated GoDaddy to enhance its security measures, including implementing multi-factor authentication and HTTPS APIs, due to significant security failures since 2018. The FTC’s complaint highlights GoDaddy’s misleading claims about its security practices, which left millions of customers vulnerable to breaches.…
Read More