Remove DNS Remove Firewall Remove Hacking Remove Information Security
article thumbnail

Muddling Meerkat, a mysterious DNS Operation involving China’s Great Firewall

Security Affairs

The China-linked threat actors Muddling Meerkat are manipulating DNS to probe networks globally since 2019. Infoblox researchers observed China-linked threat actors Muddling Meerkat using sophisticated DNS activities since 2019 to bypass traditional security measures and probe networks worldwide.

DNS 124
article thumbnail

Chinese DriftingCloud APT exploited Sophos Firewall Zero-Day before it was fixed

Security Affairs

China-linked threat actors exploited the zero-day flaw CVE-2022-1040 in Sophos Firewall weeks before it was fixed by the security vendor. On March 25, Sophos announced to have fixed the authentication bypass vulnerability, tracked as CVE-2022-1040, that resides in the User Portal and Webadmin areas of Sophos Firewall.

Firewall 131
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Chinese StormBamboo APT compromised ISP to deliver malware

Security Affairs

Volexity researchers reported that a China-linked APT group, tracked as StormBamboo (aka Evasive Panda , Daggerfly , and StormCloud), successfully compromised an undisclosed internet service provider (ISP) in order to poison DNS responses for target organizations. The company linked the attacks to StormBamboo APT group.

Malware 135
article thumbnail

Usage of TLS in DDNS Services leads to Information Disclosure in Multiple Vendors

Security Affairs

The use of Dynamic DNS (DDNS) services embedded in appliances can potentially expose data and devices to attacks. The use of Dynamic DNS (DDNS) services embedded in appliances, such as those provided by vendors like Fortinet or QNAP, carries cybersecurity implications. For instance, suppose firewall manufacturer ACME Inc.

DNS 118
article thumbnail

Security Affairs newsletter Round 385

Security Affairs

SecurityAffairs – hacking, newsletter). The post Security Affairs newsletter Round 385 appeared first on Security Affairs. If you want to also receive for free the newsletter with the international press subscribe here. gov adds more Chinese Telecom firms to the Covered List Imperva blocked a record DDoS attack with 25.3

article thumbnail

Static SSH host key in Cisco Umbrella allows stealing admin credentials

Security Affairs

Umbrella is Cisco’s cloud-based Secure Internet Gateway (SIG) platform that provides users with multiple levels of defense against internet-based threats. Umbrella integrates secure web gateway, firewall, DNS-layer security, and cloud access security broker (CASB) functionality to protect systems against threats.

DNS 115
article thumbnail

New Ttint IoT botnet exploits two zero-days in Tenda routers

Security Affairs

Unlike other IoT DDoS botnets, Ttint implements 12 remote access functions such as Socket5 proxy for router devices, tampering with router firewall and DNS settings, executing remote custom system commands. SecurityAffairs – hacking, Ttint botnet). Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

IoT 141