Tag: PASSWORD

Gootloader inside out
The Gootloader malware employs sophisticated social engineering tactics to infect users through compromised WordPress sites. It manipulates search engine results to direct victims to these sites, where they encounter fake message boards that link to the malware. The infection process is complex and heavily obfuscated, making it difficult for even site owners to detect.…
Read More
FTC sues GoDaddy for years of poor hosting security practices
Summary: The Federal Trade Commission (FTC) has mandated GoDaddy to enhance its security measures, including implementing multi-factor authentication and HTTPS APIs, due to significant security failures since 2018. The FTC’s complaint highlights GoDaddy’s misleading claims about its security practices, which left millions of customers vulnerable to breaches.…
Read More
Researchers Find Exploit Allowing NTLMv1 Despite Active Directory Restrictions
Summary: Cybersecurity researchers have discovered that a misconfiguration in on-premise applications can bypass Microsoft’s Group Policy designed to disable NT LAN Manager (NTLM) v1 authentication. This vulnerability allows organizations to mistakenly believe they are protected against NTLMv1 attacks, while in reality, they remain exposed due to misconfigured settings.…
Read More
The Cyber Threat Responsible for the Biggest Breaches of 2024
Summary: Stolen credential-based attacks have surged, becoming the leading cyber threat in 2023/24, with a staggering 80% of web app attacks originating from this breach vector. Despite increased cybersecurity budgets, vulnerabilities remain due to inadequate MFA adoption and the rise of infostealer malware. This article explores the factors contributing to the rise in account compromises and offers recommendations for security teams to combat these threats.…
Read More
Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service
In December 2024, a new Adversary-in-the-Middle (AiTM) phishing kit known as Sneaky 2FA was identified, targeting Microsoft 365 accounts. This phishing kit, sold as Phishing-as-a-Service (PhaaS) by the cybercrime service “Sneaky Log”, utilizes sophisticated techniques including autograb functionality and anti-bot measures. The analysis reveals its operational methods, including the use of Telegram for distribution and support.…
Read More
Securonix Threat Labs 2024 Annual Autonomous Threat Sweeper Intelligence Insights
The 2024 Annual Cyber Threat Report reveals a significant increase in cyber threats, including advanced persistent threats (APTs) and evolving tactics used by attackers. Key incidents include the resurgence of LockBit ransomware, exploitation of vulnerabilities in widely-used technologies, and notable data breaches affecting major organizations. Affected: Ivanti Connect Secure, GlobalProtect, CrowdStrike, Snowflake, Palo Alto Networks

Keypoints :

Emerging threats exploit vulnerabilities in Ivanti Connect Secure and GlobalProtect VPN.…
Read More
Victim: FortiGate Users | FortiGate Price: N/A Data: VPN Credentials, Firewall Configurations

Keypoints :

Threat Actor: Belsen Group Number of Exposed Configurations: Over 15,000 Data Types Leaked: Usernames, passwords (some in plain text), device management certificates, complete firewall rule sets Vulnerability Exploited: CVE-2022-40684 Data Organization: Categorized by country with individual IP addresses Potential Risks: Unauthorized network access and exploitation of sensitive information Expert Confirmation: Kevin Beaumont verified the authenticity of the leaked data

Cybersecurity expert Kevin Beaumont has reported that over 15,000 FortiGate firewall configurations, including VPN credentials, have been publicly leaked by a group calling itself “Belsen Group.”…

Read More
Hackers leak configs and VPN credentials for 15,000 FortiGate devices
Summary: A new hacking group known as the Belsen Group has leaked sensitive configuration files, IP addresses, and VPN credentials for over 15,000 FortiGate devices on the dark web. This data dump, which includes critical technical information, was released to promote the group and is believed to be linked to a previously exploited zero-day vulnerability.…
Read More
Microsoft Patch Tuesday January 2025 Security Update Review Qualys ThreatPROTECT
January 2025 marks the release of Microsoft’s first Patch Tuesday, addressing 159 vulnerabilities, including 10 critical and 149 important. Among these, eight zero-day vulnerabilities have been patched, with three actively exploited. Key updates include fixes for various Microsoft products, notably in Windows and Microsoft Office. Affected: Microsoft Windows, Microsoft Office, .NET,…
Read More
Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks
Summary: Cybersecurity researchers have identified multiple vulnerabilities in SimpleHelp remote access software that could lead to serious security breaches, including information disclosure and remote code execution. The flaws, which are easy to exploit, necessitate immediate action from users to apply patches and enhance security measures.

Threat Actor: Unknown | unknown Victim: SimpleHelp | SimpleHelp

Key Point :

CVE-2024-57727: Unauthenticated path traversal vulnerability allowing file downloads, including sensitive configuration files.…
Read More
Zombies Never Die: Analysis of the Current Situation of the Large Zombie Network AIRASHI
A large-scale DDoS attack targeted the Chinese game “Black Myth: Wukong” on the Steam and Perfect World platforms in August 2024. The attackers, using a botnet called AISURU, executed multiple waves of attacks during peak online gaming hours across 13 global regions. The botnet was later updated and renamed AIRASHI, which exhibited advanced capabilities, including exploiting a 0DAY vulnerability in Cambium Networks routers.…
Read More
Kimsuky Hacking Group’s Malware Attack on the Korean Defense Industry Association – Defense Industry Digital Innovation Seminar (Planned) (2025.1.12)
This article discusses the malicious activities of the North Korean hacking group Kimsuky, which targets the Korea Association of Defense Industry Studies. The group is known for its various espionage missions, including the distribution of malware disguised as a seminar invitation. The malware is delivered via email and executes harmful scripts upon opening an attached document.…
Read More
Volt Typhoon: Analyzing Espionage Campaigns Against Critical Infrastructure
Volt Typhoon, a Chinese state-sponsored APT group, is known for targeting critical infrastructure in the US, UK, Canada, and Australia by exploiting vulnerabilities in outdated SOHO devices. Their stealthy tactics involve using legitimate tools to blend malicious activities with normal network traffic, making detection difficult. Affected: United States, United Kingdom, Canada, Australia

Keypoints :

Volt Typhoon is linked to espionage and information gathering targeting critical infrastructure.…
Read More
VMware ESXi Logging and Detection Opportunities
This article discusses the unique challenges faced by Detection Engineers in securing ESXi environments, which often lack adequate security controls. It highlights the importance of effective log sources, common adversary techniques, and provides a Python-based CLI tool for automating detection tasks. Affected: ESXi

Keypoints :

ESXi environments are often considered legacy and may lack effective maintenance and security controls.…
Read More