article thumbnail

Chinese national charged for hacking thousands of Sophos firewalls

Security Affairs

has charged a Chinese national for hacking thousands of Sophos firewall devices worldwide in 2020. has charged the Chinese national Guan Tianfeng (aka gbigmao and gxiaomao) for hacking thousands of Sophos firewall devices worldwide in 2020. It was designed to download payloads intended to exfiltrate XG Firewall-resident data.

article thumbnail

Threat Trends: Firewall

Cisco Security

In any perimeter defense a key component is firewalls—the proverbial guard towers in your fortifications. In this Threat Trends release, we’ll be looking at Cisco Secure Firewall. The goal is to highlight the common threats that organizations encounter and block with Secure Firewall. Secure Firewall version 7.0

Firewall 145
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

MyBook Users Urged to Unplug Devices from Internet

Krebs on Security

” Western Digital’s brief advisory includes a link to an entry in the National Vulnerability Database for CVE-2018-18472. Examine the CVE attached to this flaw and you’ll notice it was issued in 2018. We are actively investigating the issue and will provide an updated advisory when we have more information.”

Internet 334
article thumbnail

Threat Spotlight: Credential Theft vs. Admin Control—Two Devastating Paths to VPN Exploitation

Digital Shadows

Key Findings Even years after their disclosure, VPN-related vulnerabilities like CVE-2018-13379 and CVE-2022-40684 remain essential tools for attackers, driving large-scale campaigns of credential theft and administrative control. CVE-2018-13379: The Eternal Exploit What is CVE-2018-13379?

VPN 133
article thumbnail

Muddling Meerkat, a mysterious DNS Operation involving China’s Great Firewall

Security Affairs

The threat actors appear to have the capability to control China’s Great Firewall and were observed utilizing a novel technique involving fake DNS MX records. The experts noticed a spike in activity observed in September 2023. However, the Infoblox researchers have yet to discover the motivation behind the attacks.

DNS 140
article thumbnail

Sophos details five years of China-linked threat actors’ activity targeting network devices worldwide

Security Affairs

Sophos used custom implants to monitor China-linked thret actors targeting firewall zero-days in a years-long battle. Since 2018, Sophos has faced increasingly aggressive campaigns, including the India-based Sophos subsidiary Cyberoam, where attackers exploited a wall-mounted display for initial access.

Firmware 120
article thumbnail

M?ris Bot infects MikroTik routers compromised in 2018

Security Affairs

The network equipment maker MikroTik revealed that the routers were previously compromised in 2018. “As far as we have seen, these attacks use the same routers that were compromised in 2018, when MikroTik RouterOS had a vulnerability, that was quickly patched.” ” reads a post published by MikroTik in a forum post.

DDOS 114