Search: “isp”

12 stories in the last 30d

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackersSep 15, 05:20 UTC · 1d agoExploit / PoC in the wild 3 sources CVE-2024-21762 CVE-2020-1938

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business NewsAug 26, 03:07 UTC · 21d agoPolicy & legal1

Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

Ukraine's top prosecutor Ruslan Kravchenko resigned after NABU arrested a deputy for taking bribes protecting scam call centers running fake investment platforms.

Ukraine's anti-corruption bureau NABU arrested Serhiy Kropyva, Deputy Head of International Cooperation at the Prosecutor General's Office, alleging officials took monthly protection fees from a network of 100-500 scam call centers luring victims into fake investment platforms, with bribes reportedly growing from $700,000 to $3.5 million per month. Prosecutor General Ruslan Kravchenko resigned on Monday, calling it a political decision, while Kropyva was fired with bail set at 120 million hryvnias ($2.7 million) and over 100 call centers shut down in the past month. The newsletter also briefly covers a cyberattack crippling more than 80 Luxembourg medical practices via payment vendor BMS Engineering, ShinyHunters' claimed theft of 200,000 Florida DMV driver records, a cyberattack on the American Meteor Society, and school closures in Springfield, Massachusetts.

Risky Business NewsSep 9, 06:06 UTC · 7d agoPhishing & fraud

The Nansh0u Campaign – Hackers Arsenal Grows Stronger

Guardicore researchers detail the Nansh0u campaign's growing arsenal, with three attacks traced to South African IPs hosted by VolumeDrive.

Guardicore security researchers analyzed three attacks detected in early April through the Guardicore Global Sensor Network (GGSN). All three attacks originated from source IP addresses in South Africa hosted by the VolumeDrive ISP. The write-up catalogs the expanding arsenal and tooling used by the Nansh0u campaign attackers and includes indicators of compromise.

Akamai BlogSep 8, 15:13 UTC · 7d agoThreat actor in the wild

IT Help Desk Impersonation Lets Hackers Bypass MFA

Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.

Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.

Security AffairsSep 8, 07:41 UTC · 8d agoPhishing & fraud in the wild1

Automobile Camouflage to Hide from Flock Cameras

Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.

The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.

Schneier on SecuritySep 7, 11:06 UTC · 9d agoResearch

Free streaming boxes may be routing criminal traffic through your home

Researchers found SuperBox streaming boxes and the CyberFlix TV app enroll home connections into the Popanet residential proxy network, routing criminal traffic.

Researchers found that SuperBox devices and the CyberFlix TV app, distributed through SuperBox's custom app store, contain Popanet proxy functionality that registers the device with servers controlled by the proxy operator, enrolling household connections into residential proxy networks. The reported configuration weakens Android safeguards with exposed ADB access, root-level privileges without authentication, and removal of app-install protections. Plume's research warns these proxy networks can also function as malware-delivery platforms, and the FBI notes foreign entities use residential proxies to conceal activity such as credential stuffing and account abuse. Malwarebytes advises disconnecting and replacing affected SuperBox/CyberFlix devices rather than factory-resetting them.

Malwarebytes LabsSep 4, 09:20 UTC · 12d agoMalware in the wild

International Operation Disrupts Sality P2P Botnet

US-led international operation with Europol, CrowdStrike, and Shadowserver sinkholed the 20-year-old Sality P2P botnet, once exceeding one million infected machines.

On August 31, 2026, authorities from the US, Bulgaria, Hungary, and Romania, supported by Europol, CrowdStrike, and the Shadowserver Foundation, disrupted the Sality P2P botnet by sinkholing communications and seizing domains. Sality has operated for over 20 years, at its peak controlling more than one million infected machines used for credential theft, spam, proxy services, crypto-theft, and DDoS attacks, with over 11 million unique IP addresses linked to its infrastructure since 2017. The disruption exploited the botnet's super-peer reputation mechanism by removing legitimate peers via protocol-level manipulation and inserting sinkhole entries into emptied peer lists.

Infosecurity MagazineSep 3, 08:30 UTC · 13d agoMalware

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm CenterSep 3, 02:02 UTC · 13d agoTools1

Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping

Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.

Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.

Help Net SecurityAug 28, 00:00 UTC · 19d agoTools

China's AI-Enabled APT Operations Are Getting Interesting

Bitdefender links seven RAT families, five previously undocumented, to China-nexus espionage actor SilkParasite using AI-assisted malware development against Central Asian governments.

A Bitdefender report attributes seven remote access tool families to a single actor dubbed SilkParasite, with medium confidence a China-nexus group targeting governments in Uzbekistan, Turkmenistan and Kazakhstan. The RATs are written in .NET, C++, Go and JavaScript, use C2 via Google Drive and protocols like HTTP, DNS and TCP, and employ modular plugin architectures with regular rotation of infrastructure, encryption material and persistence artifacts. Evidence of AI-assisted development includes leftover test functions, placeholder encryption keys, and GoginRAT and NomadRAT sharing a high-level architecture despite different languages, suggesting a specification implemented twice with AI. The newsletter also covers the US Operation Economic Outcast sanctioning six MOIS-linked Iranian hackers, including hands-on-keyboard operators who targeted US critical infrastructure.

Risky Business NewsAug 27, 05:05 UTC · 20d agoThreat actor1

NETSCOUT expands Adaptive DDoS Protection with outbound attack mitigation

NETSCOUT extended Adaptive DDoS Protection to detect and mitigate outbound DDoS traffic at source, targeting IoT botnet attacks like Turbo-Mirai.

NETSCOUT announced an extension of its Adaptive DDoS Protection (ADP) for service providers to automatically detect and mitigate outbound DDoS traffic from compromised subscriber devices such as broadband routers and IoT devices. The capability addresses Turbo-Mirai-class botnets capable of multi-terabit attacks and integrates with Arbor Sightline, Arbor Threat Mitigation System, the ATLAS Intelligence Feed, and ASERT analysts. Source-side mitigation aims to reduce outages, transit costs, peering damage, and abuse complaints at ISPs.

Help Net SecurityAug 18, 00:00 UTC · 29d agoTools