Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label DDOS Attacks. Show all posts
NightmareStresser
Cyber Security DDOS Attacks FBI NightmareStresser

FBI Seizes NightmareStresser DDoS-for-Hire Domains in Global Crackdown

 

The U.S. Department of Justice has announced the court-authorized seizure of internet domains linked to “NightmareStresser,” one of the world’s longest-running Distributed Denial of Service (DDoS) for-hire services. The operation, led by the FBI Anchorage Field Office with support from the Royal Canadian Mounted Police, targets so-called “booter” and “stresser” platforms that enable paying customers to launch powerful cyberattacks against individuals, organizations, and critical online infrastructure across Alaska and globally. 

According to the seizure warrant affidavit, NightmareStresser was used to carry out hundreds of thousands of actual or attempted DDoS attacks worldwide since 2022. These services lower the barrier to entry for cybercrime by allowing users with minimal technical expertise to disrupt internet connections, knock targeted devices offline (“booting”), and degrade or completely interrupt access to websites and online services. Victims have included schools, government agencies, gaming platforms, and millions of everyday users whose connectivity was affected by these coordinated attacks.

The takedown forms part of Operation PowerOFF, an ongoing international law enforcement initiative aimed at dismantling criminal DDoS-for-hire infrastructures and holding both administrators and users accountable. Over the past eight years, federal prosecutors and investigators in Anchorage and Los Angeles have charged twelve defendants involved in facilitating DDoS-for-hire services and seized more than 100 associated domains. This latest action expands on those efforts by targeting all known booter sites, shutting down as many as possible, and coupling enforcement with a public education campaign on the harms caused by illegal DDoS activity. 

Assistant U.S. Attorneys Adam Alexander and Ainsley McNerney are prosecuting the case in the District of Alaska. The Justice Department emphasizes that booter and stresser services not only harm direct targets but also undermine broader internet reliability and safety. As digital dependence grows, such crackdowns signal a sustained push to disrupt the ecosystem enabling low-cost, high-impact cyberattacks—and to deter would-be offenders by removing the domains and infrastructure these services rely on to operate.
Read more »
malware
Atlassian DDOS Attacks Evooo1Bot FortiGuard Lab HTTP Linux botnet malware

Evooo1Bot Hijacks Linux Routers for Proxying, Credential Theft and DDoS Attacks



A new Linux botnet named Evooo1Bot is turning internet-facing routers and other gateway devices into SOCKS5 traffic relay nodes, giving attackers a way to route malicious connections through compromised systems while retaining the ability to steal credentials, brute-force SSH accounts, exploit vulnerable devices and launch DDoS attacks.

FortiGuard Labs said it has been tracking the Mirai-based malware since at least July 2026, with activity observed against devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link across multiple regions. Rather than relying on a single attack function, Evooo1Bot combines several capabilities within a modular Linux malware framework.

The malware retains the DDoS engine from the publicly leaked Mirai source code, but expands on the older botnet's approach with encrypted command-and-control communications, an SSH brute-force scanner, a SOCKS5 relay, a credential sniffer and an exploitation module targeting known vulnerabilities.

Mirai's original success was closely tied to internet-connected devices such as routers, cameras and DVRs, many of which were exposed with weak or default credentials. Fortinet previously documented how Mirai could scan for vulnerable systems, brute-force credentials and recruit them into a remotely controlled botnet.

Evooo1Bot takes that model further by adding more ways to use a compromised device after the initial infection.

Its exploit arsenal covers a wide range of internet-facing technologies. Newer builds have been found with modules targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx and vulnerable PHP-CGI installations. FortiGuard noted, however, that some of the embedded exploits are incorrectly implemented and fail to compromise their intended targets.

When exploitation succeeds, the malware downloads a build suited to the victim's CPU architecture. FortiGuard identified 12 available builds, allowing the operators to target different Linux-based hardware rather than relying on a single binary.

The malware then attempts to make the compromise harder to trace. It clears Bash history and establishes persistence through mechanisms including systemd, SysV init, shell profiles and "rc.local". A cron job also attempts to download the payload again every five minutes, providing another way to restore the malware if it is removed.

Evooo1Bot also checks its surroundings before fully activating. It searches for debuggers, security software, sandboxes, virtual machines, containers and honeypots, indicating that the operators are attempting to distinguish ordinary victims from environments where the malware could be analyzed.

Its encrypted C2 communications operate over port 443, while an interactive shell gives operators direct control over infected systems. The malware also supports file uploads and downloads and uses a 28-command interface for remote operations.

The SOCKS5 component is where Evooo1Bot moves beyond the conventional DDoS-botnet model.

A SOCKS5 proxy can relay network connections through another system. In this case, the infected router becomes the intermediary, allowing attackers to send traffic through the victim's connection. Evooo1Bot supports both direct-listening and reverse-relay modes, which could help operators conceal the origin of malicious traffic, bypass geographic restrictions or reach networks accessible through compromised devices.

Multiple proxy sessions can operate independently, raising another possibility if the botnet expands: monetizing compromised residential connections as proxy infrastructure.

The malware also monitors "/proc/net/tcp" for network activity and attempts to capture HTTP Basic Authentication and Cookie headers. Alongside its shell and file-transfer functions, this gives operators additional opportunities to obtain information from systems positioned behind the compromised gateway.

SSH provides another route into vulnerable systems. Evooo1Bot uses 150 username and password combinations aimed at enterprise-oriented accounts and performs checks after successful authentication to identify possible honeypots.

DDoS remains part of the malware's toolkit, with 16 flood methods inherited from Mirai, including UDP, DNS, SYN, ACK, GRE, fragmented TCP and customizable HTTP floods.

The result is a botnet in which a compromised router can serve several purposes at once: it can participate in DDoS attacks, relay traffic, collect authentication material, provide remote shell access and help operators compromise additional vulnerable systems.

For users and organizations, securing these devices starts with applying firmware and security updates, replacing default administrator credentials and disabling unnecessary remote-access interfaces. Unsupported equipment that no longer receives security updates should also be replaced.

Network defenders should additionally watch for unexpected outbound connections, unusual proxy traffic and unauthorized changes to cron jobs, startup services or shell profiles.

Evooo1Bot shows why internet-facing routers and gateways cannot be treated simply as passive networking equipment. Once compromised, they can become operational infrastructure for an attacker, extending the intrusion far beyond the device itself.

Read more »
residential proxy network
Botnet attack Cyber Security DDOS Attacks Dutch Police malware infection residential proxy network

Dutch Authorities Dismantle Massive Botnet Network Linked to 17 Million Compromised Devices

 

Dutch authorities have shut down what is believed to be one of the largest botnet operations ever uncovered, disrupting a cybercrime network that compromised more than 17 million internet-connected devices globally. The affected devices reportedly included computers, smartphones, tablets, security cameras, and other connected hardware that were unknowingly used to facilitate large-scale cyberattacks.

According to Dutch investigators, approximately 200 servers located in the Netherlands were seized as part of the operation. These servers allegedly formed the backbone of a sophisticated botnet infrastructure that transformed infected devices into components of a residential proxy network.

A botnet is a collection of compromised devices that cybercriminals can remotely control after infecting them with malware. Such networks are commonly used to launch Distributed Denial of Service (DDoS) attacks, distribute phishing campaigns, send spam, commit fraud, and conceal the origins of malicious online activities.

Dutch media outlet NL Times reported that cybercriminals targeted devices with weak security protections, converting them into nodes within a residential proxy service. Once infected, the devices were used to redirect internet traffic and allegedly help "launch large-scale cyberattacks" without the owners' knowledge. Authorities confirmed that the network has now been taken offline.

The investigation began after a cybersecurity researcher working with the National Cyber Security Centre (NCSC) identified suspicious activity linked to the botnet. The NCSC, which operates under the Netherlands' Ministry of Justice and Security, subsequently partnered with Dutch law enforcement agencies to investigate the case. Their efforts led to the identification and seizure of the servers supporting the operation.

While authorities have not disclosed the exact method used to infect more than 17 million devices, cybersecurity experts note that botnets are commonly spread through malicious applications, software vulnerabilities, phishing campaigns, and brute-force attacks.

The dismantled network has reportedly been linked by NL Times to Asocks, a residential proxy service that has previously faced scrutiny over alleged connections to botnet-related activities. However, Dutch police have not officially confirmed any association.

In 2024, cybersecurity company HUMAN reported that a botnet known as Proxylib had infected nearly 190,000 devices and integrated them into Asocks' proxy network. Researchers connected that operation to a discontinued VPN service and at least 28 Android applications.

Residential proxy services route internet traffic through the IP addresses of ordinary users, making online activity appear to originate from legitimate residential locations. While such services can have lawful uses, including bypassing geographic restrictions, experts warn that they are increasingly being exploited by cybercriminals.

Following the takedown, the NCSC updated its guidance on residential proxy networks and highlighted the risks they pose. In an updated statement, the agency said the enforcement action "demonstrates" how residential proxies pose "a threat to national and international cybersecurity."

The agency further warned that the technique is "being deployed more and more frequently in digital attacks," enabling activities such as DDoS attacks, phishing campaigns, credential theft, brute-force attacks, malware distribution, and SMS pumping.

The operation reflects a broader international effort to combat cybercrime infrastructure. In March, authorities from Germany, Canada, and the United States coordinated actions against two major botnets known as "Aisuru" and "Kimwolf," which were allegedly responsible for large-scale DDoS attacks. U.S. authorities reported that those networks had compromised more than three million devices.

Earlier this year, Google disrupted the IPIDEA proxy network, whose development kits were reportedly used by the Kimwolf botnet. Separately, the Netherlands' Fiscal Information and Investigation Service (FIOD) seized more than 800 servers connected to an illegal hosting platform allegedly used for botnet and malware-related activities.

Cybersecurity experts continue to advise users to strengthen their digital defenses by creating strong passwords, regularly updating software, monitoring network activity, enabling WPA2 or WPA3 Wi-Fi security protocols, and avoiding downloads from unverified sources. Users are also encouraged to carefully review application permissions and terms of service to ensure their devices are not unknowingly enrolled in proxy networks. Traditional antivirus protection remains an important layer of defense against evolving cyber threats.

Read more »
Infrastructure Security
API Cyber Attacks Cybersecurity Attack DDoS DDOS Attacks Hacker attack Infrastructure Security

Ubuntu DDoS Attack Disrupts Installs Updates and Canonical Infrastructure

 

A wave of traffic overwhelmed systems, briefly halting downloads, patches, and web resources managed by Canonical - the team responsible for Ubuntu Linux. Outages stretched nearly twenty-four hours, blocking access to essential tools during the incident. 

Midway through the disruption, Canonical confirmed issues affecting its online systems, calling them a prolonged international cyber incident. With efforts already underway to bring functions back online, progress reports were expected later via verified sources after conditions improved. 

Not just external sites felt the impact - insights from casual chats on unaffiliated Ubuntu message boards pointed to deeper issues. Failures popped up across several core functions: the security API stumbled, repository access broke, setup tools froze, package upgrades failed. When the outage struck, countless machines could neither pull patches nor start clean installs. The ripple spread wider than first assumed. 

A claim of responsibility emerged afterward, attributed to an entity calling itself The Islamic Cyber Resistance in Iraq 313 Team. Supposed messages circulated on Telegram suggest they relied on a service named Beemed - one that facilitates distributed denial-of-service attacks - to execute the incident. While details remain sparse, the method points toward accessible cyber tools being leveraged for disruptive purposes. Heavy network floods emerge when tools like Beamed hand out DDoS power to anyone willing to pay, masking harm behind so-called "testing" labels. 

Instead of building safeguards, some misuse these setups to drown web systems in endless data streams. With advertised force climbing toward 3.5 terabits each second, one sees how readily extreme digital pressure becomes a purchasable option. A single flood of fake signals can overwhelm digital infrastructure when launched from countless hijacked gadgets online. 

Such an event forces critical systems to choke on excessive demand, blocking normal access. Real people experience delays or complete service failures as their requests get lost in chaos. Machines turned into unwilling helpers generate relentless noise instead of useful responses. Performance drops sharply once capacity limits are breached without warning. Genuine interactions fade under pressure from artificial congestion. 

Most times, hacking groups start by slipping malicious software onto gadgets, sometimes using poor login codes instead of strong ones. From there, machines already taken over get bundled together - forming massive clusters run from far away via command centers online. These hijacked setups often change hands in hidden digital bazaars; launching short outages becomes possible for cheap, while heavier assaults require deeper spending. 

What follows? Buyers pick time-limited chaos or go all-in for longer surges. Surprisingly, more DDoS attacks happen now due to widespread access to self-running malware that exploits weak device protections across countries. While strong networks may resist some threats, major companies still face interruptions since hackers pair huge bot-driven data floods with focused attack plans.  

The Ubuntu event underscores how fragile key open-source tools have become - tools that developers, businesses, and public agencies depend on worldwide. When update servers or security interfaces go offline briefly, ripple effects follow. Patching halts. System rollouts stall. All of this unfolds while digital attacks are already underway.
Read more »
malware
Aisuru botnet Android Malware Black Lotus Labs command and control servers cybersecurity research DDOS Attacks Kimwolf botnet Lumen security malware

Lumen Disrupts Aisuru–Kimwolf Botnet Powering Massive DDoS Attacks

 

Lumen Technologies’ Black Lotus Labs has successfully disrupted more than 550 command-and-control (C2) servers connected to the Aisuru and Kimwolf botnets, a large-scale malicious infrastructure widely used for distributed denial-of-service (DDoS) attacks and residential proxy abuse.

Aisuru operates as a DDoS-for-hire platform and deliberately avoids targeting government and military entities. However, broadband service providers have borne the brunt of its activity, with attacks surpassing 1.5Tb/sec originating from compromised customer devices, causing severe service interruptions.

Similar to other TurboMirai-based botnets, Aisuru includes enhanced DDoS capabilities alongside multifunctional features. These allow threat actors to engage in a range of illegal operations such as credential stuffing, AI-powered web scraping, spam campaigns, phishing attacks, and proxy services.

The botnet launches assaults using UDP, TCP, and GRE flood techniques, leveraging medium-sized packets with randomized ports and flags. Traffic volumes exceeding 1Tb/sec from infected customer premises equipment (CPEs) have disrupted broadband networks, while packet floods surpassing 4 billion packets per second have led to router line card failures.

Kimwolf, a recently identified Android-based botnet closely associated with Aisuru, has compromised more than 1.8 million devices and generated over 1.7 billion DDoS commands, according to cybersecurity firm XLab.

Primarily targeting Android TV boxes, the Kimwolf botnet is built using the Android NDK and includes capabilities such as DDoS attacks, proxy forwarding, reverse shell access, and file management. To conceal its operations, it encrypts sensitive information using a simple Stack XOR method, employs DNS over TLS for communication obfuscation, and verifies C2 commands through elliptic curve digital signatures. Newer variants also use EtherHiding, leveraging blockchain-based domains to evade takedown efforts.

Kimwolf variants follow a consistent naming convention of “niggabox + v[number],” with versions v4 and v5 currently observed in the wild. Researchers who seized control of a single C2 domain recorded interactions from approximately 2.7 million IP addresses within three days, reinforcing estimates that infections exceed 1.8 million devices. The botnet’s globally distributed infrastructure, multiple C2 servers, and varied versions make precise infection counts difficult.

Although Kimwolf borrows elements from the Aisuru codebase, its operators significantly modified it to avoid detection. While traffic proxying is its primary function, the botnet is capable of executing large-scale DDoS campaigns. This was evident during a three-day window between November 19 and 22, when it issued 1.7 billion attack commands.

Lumen observed daily bot traffic to Aisuru C2 servers rise sharply from 50,000 to 200,000 connections in September 2025. Upon validating the emergence of a new botnet, the company blocked the traffic and null-routed more than 550 C2 servers.

By examining C2 infrastructure and residential proxy traffic, researchers traced links to Canadian IP addresses and shared this intelligence with law enforcement agencies.

“The Canadian IPs in question were using SSH to access 194.46.59[.]169, which resolved to proxy-sdk.14emeliaterracewestroxburyma02132[.]su. In short order, we would learn that the Aisuru backend C2 we were tracking adopted the domain name client.14emeliaterracewestroxburyma02132[.]su, a similarity that further tied these servers together” reads the report published by Lumen.

In early October, Black Lotus Labs detected infrastructure shifts signaling the rise of the Kimwolf botnet. Its growth was rapid, adding hundreds of thousands of infected devices within weeks, largely through exploitation of insecure residential proxy services. By mid-October, infections had reached approximately 800,000 devices, with the botnet actively scanning proxy networks to accelerate expansion.

Black Lotus Labs initiated disruption efforts against Kimwolf in October by swiftly null-routing its C2 servers. While operators were able to reestablish operations within hours, Lumen persistently blocked new infrastructure as it surfaced. Through continuous monitoring, collaboration with industry partners, and integration of threat indicators into its security products, Lumen worked to reduce the botnet’s operational capacity over time.

“To date, we have null-routed over 550 Aisuru/Kimwolf servers in 4 months as part of our efforts to combat this botnet, leading its operators to some distress, as noted in Xlabs’ post, showing the actors addressing Lumen with profanity in one DDoS payload” concludes the report.


Read more »
France
Bank Data Bank Security Banking Cyberattack Cyber Attacks DDoS DDOS Attacks France

France Postal and Banking Services Disrupted by Suspected DDoS Cyberattack

 

France’s national postal and banking services faced major disruption following a suspected distributed denial-of-service (DDoS) attack that affected key digital systems. La Poste, the country’s postal service, described the incident as a significant network issue that impacted all of its information systems, forcing the temporary suspension of several online services. The disruption affected both postal and banking operations at a national level. 

As a result of the incident, La Poste’s website, mobile application, online mail services, and digital banking platforms were taken offline. While online access was unavailable, the company stated that customers could still carry out postal and banking transactions in person at physical locations. The outage caused inconvenience for users who rely on digital services for routine tasks such as checking account balances, paying bills, or managing mail. 

La Banque Postale, the banking subsidiary of La Poste, also confirmed the cyber incident. The bank reported that the attack temporarily prevented customers from accessing its mobile banking app and online banking services. Both La Poste and La Banque Postale said technical teams were actively working to restore services, although no clear timeline for full recovery was provided.  

A Russian hacktivist group claimed responsibility for the attack, but French authorities have not confirmed who was behind it. Officials have not publicly attributed the incident to any specific group and continue to investigate the source and method of the attack. This uncertainty highlights the broader challenge of identifying and verifying perpetrators behind DDoS attacks, which are often difficult to trace due to their distributed nature. 

The disruption at La Poste comes amid a wider series of cybersecurity concerns in France. In recent weeks, the French government has dealt with multiple digital security incidents, including the discovery of remotely controllable software reportedly planted on a passenger ferry. These events have raised concerns about the security of critical infrastructure and essential public services. 

In a separate incident, the French Interior Ministry disclosed a data breach involving unauthorized access to email accounts and the theft of sensitive documents, including criminal records. Authorities later announced the arrest of a 22-year-old suspect in connection with that breach, though no name was released. It remains unclear whether the attack on La Poste is linked to this or other recent cybersecurity incidents. French officials have not indicated whether the recent attacks share common origins or motives. 

However, the growing number of incidents has increased scrutiny of national cybersecurity defenses and intensified concerns about the rising frequency and impact of cyberattacks on vital public services.
Read more »
Vulnerability Exploits
AWS Cloud Outage Risks Cyber Threats DDOS Attacks Firmware Security IOT Security malware Mirai Network Defense ShadowV2 Botnet Vulnerability Exploits

ShadowV2 Botnet Activity Quietly Intensified During AWS Outage

 


The recently discovered wave of malicious activity has raised fresh concerns for cybersecurity analysts, who claim that ShadowV2 - a fast-evolving strain of malware that is quietly assembling a global network of compromised devices - is quietly causing alarm. It appears that the operation is based heavily upon Mirai's source code and is much more deliberate and calculated than previous variants. The operation is spread across more than 20 countries. 

Moreover, ShadowV2 has been determined to have been created by actors exploiting widespread misconfigurations in everyday Internet of Things hardware. This is an increasingly common weakness in modern digital ecosystems and it is aimed at building a resilient, stealthy, and scaleable botnet. The campaign was discovered by FortiGuard Labs during the Amazon Web Services disruption in late October, which the operators appeared to have been using to cover up their activity. 

During the outage, the malware spiked in activity, an activity investigators interpret to be the result of a controlled test run rather than an opportunistic attack, according to the report. During its analysis of devices from DDWRT (CVE-2009-2765), D-Link (CVE-2020-25506, CVE-2022-37055, CVE-2024-10914, CVE-2024-10915), DigiEver (CVE-2023-52163), TBK (CVE-2024-3721), TP-Link (CVE-2024-53375), and DigiEver (CVE-2024-53375), ShadowV2 was observed exploiting a wide range of CVE-2024-53375. 

A campaign’s ability to reach out across industries and geographies, coupled with its precise use of IoT flaws, is indicative of a maturing cybercriminal ecosystem, according to experts. This ecosystem is becoming increasingly adept at leveraging consumer-grade technology to stage sophisticated and coordinated attacks in the future. 

ShadowV2 exploited a variety of vulnerabilities that have been identified for a long time in IoT security, particularly in devices that have already been retired by manufacturers. This report, which is based on a research project conducted by NetSecFish, identified a number of vulnerabilities that could be affecting D-Link products that are at the end of their life cycle. 

The most concerning issue is CVE-2024-10914, which is a command-injection flaw affecting end-of-life D-Link products. In November 2024, a related issue, CVE-2024-10915, was found by researchers in a report published by NetSecFish. However, after finding no advisory, D-Link later confirmed that the affected devices had reached end of support and were unpatched. 

The vendor responded to inquiries by updating an existing bulletin to include the newly assigned CVE and issuing a further announcement that has directly related to the ShadowV2 campaign, reminding customers that outdated hardware will no longer receive security updates or maintenance, and that security updates will not be provided on them anymore. 

During the same period, a vulnerability exploited by the botnet, CVE-2024-53375, was revealed. This vulnerability has been reported to have been resolved through a beta firmware update. Considering that all of these lapses are occurring together, they serve as an excellent illustration of the fact that aging consumer devices continue to serve as a fertile ground for large-scale malicious operations long after support has ended, as many of these devices are left running even after support has ended. 

Based on the analysis of the campaign, it seems as though ShadowV2's operators use a familiar yet effective distribution chain to spread its popularity and reach as widely as possible. By exploiting a range of vulnerable IoT vulnerabilities, the attackers are able to download a software program known as binary.sh, which is located at 81[.]88[.]18[.]108, which is the command server's location. As soon as the script is executed, it fetches the ShadowV2 payload - every sample is identified by the Shadow prefix - which is similar to the well-known Mirai offshoot LZRD in many ways.

A recent study examining the x86-64 build of the malware, shadow.x86_64, has found that the malware initializes its configuration and attack routines by encoding them using a light-weight XOR-encoding algorithm, encrypting them with one byte (0x22) to protect file system paths, HTTP headers, and User-Agent strings using a single byte key. 

As soon as these parameters are decoded, the bot connects with its command-and-control server, where it waits for instructions on how to launch distributed denial-of-service attacks. While aesthetically modest in nature, this streamlined design is a reflection of a disciplined and purpose-built approach which makes it easy for deployment across diverse hardware systems without attracting attention right away. 

According to Fortinet, a deeper analysis of the malware—which uses XOR capabilities to encrypt configuration data and compact binaries—underscores that ShadowV2 shares many of the same features as the LZRD strain derived from Mirai. This allows ShadowV2 to minimize its visibility on compromised systems in a similar fashion. 

An infection sequence that has been observed across multiple incidents follows a consistent pattern: attackers are the ones who break into a vulnerable device, then they download the ShadowV2 payload via 81[.]88[.]18[.]108, and then they proceed to install it. The malware connects to its command server at silverpath[.]shadowstresser[.]info immediately after it has been installed, allowing it to be part of a distributed network geared towards coordinated attacks. 

Once installed, the malware immediately resides on the compromised device. In addition to supporting a wide range of DDoS techniques, including UDP, TCP, and HTTP, the botnet is well suited for high-volume denial-of-service operations, including those associated with for-hire DDoS services, criminal extortion, and targeted disruption campaigns. 

Researchers claim that ShadowV2's initial activity window may have been purposefully chosen to be the right time to conduct its initial operations. It is perfectly possible to test botnets at an early stage in the early stages of their development during major outages, such as the AWS disruption of late October, as sudden traffic irregularities are easily blended into the broader instability of the service. 

By targeting both consumer-grade and enterprise-grade IoT systems, operators seem to be building an attack fabric that is flexible and geographically diffuse, and capable of scaling rapidly, even in times of overwhelming defensive measures. While the observation was brief, analysts believe that it served as a controlled proof-of-concept that could be used to determine if a more expansive or destructive return could occur as a result of future widespread outages or high-profile international events. 

Fortinet has issued a warning for consumers and organizations to strengthen their defenses before similar operations occur in the future, in light of the implications of the campaign. In addition to installing the latest firmware on all supported IoT and networking devices, the company emphasizes the importance of decommissioning any end-of-life D-Link or other vendor devices, as well as preventing unnecessary internet-exposed features such as remote management and UPnP, to name just a few. 

Additionally, IoT hardware should be isolated within segmented networks, outbound traffic and DNS queries are monitored for anomalies, and strong, unique passwords should be enforced across all interfaces of all connected devices. As a whole, these measures aim to reduce the attack surface that has enabled the rapid emergence of IoT-driven botnets such as ShadowV2 to flourish. 

As for ShadowV2's activity, it has only been limited to the short window of the Amazon Web Services outage, but researchers stress that it should act as a timely reminder of the fragile state of global IoT security at the moment. During the campaign, it is stressed that the continued importance of protecting internet-connected devices, updating firmware regularly, and monitoring network activity for unfamiliar or high-volume traffic patterns that may signal an early compromise of those devices has been underscored. 

Defendants will benefit from an extensive set of indicators of compromise that Fortinet has released in order to assist them with proactive threat hunting, further supporting what researcher Li has described as an ongoing reality in cybersecurity: IoT hardware remains one of the most vulnerable entry points for cybercriminals. When ShadowV2 emerged, there was an even greater sense of concern when Microsoft disclosed just days later, days after its suspected test run, that Azure had been able to defend against what they called the largest cloud-based DDoS attack ever recorded. 

As a result of this attack, attributed to the Aisuru botnet, an unprecedented 15.72 Tbps was reached, resulting in nearly 3.64 billion packets per second being delivered. Despite the attack, Microsoft reported that it had successfully been absorbed by its cloud DDoS protection systems on October 24, thus preventing any disruptions to customer workflows. 

Analysts suggest that the timing of the two incidents indicates a rapidly intensifying threat landscape in which adversaries are increasingly preparing to launch large-scale attacks, often without much advance notice. Analysts are pointing out that the ShadowV2 incident is not merely an isolated event, but should also be considered a preview of what a more volatile era of botnet-driven disruption might look like once the dust settles on these consecutive warning shots. 

Due to the convergence of aging consumer hardware and incomplete patch ecosystems, as well as the increasing sophistication of adversaries, an overlooked device can become a launchpad for global-scale attacks as a result of this emergence. According to experts, real resilience will require more than reactive patching: settings that embed sustained visibility into their networks, enforcing strict asset lifecycle management, and incorporating architectures that limit the blast radius of inevitable compromises are all priorities that need to be addressed. 

Consumers also play a crucial role in preventing botnets from spreading by replacing unsupported devices, enabling automatic updates, and regularly reviewing router and Internet-of-Things configurations, which collectively help to reduce the number of vulnerable nodes available to botnets. 

In the face of attacks that demonstrate a clear willingness to demonstrate their capabilities during times of widespread disruption, cybersecurity experts warn that proactive preparedness must replace event-based preparedness as soon as possible. As they argue, the ShadowV2 incident serves as a timely reminder that strengthening the foundations of IoT security today is crucial to preventing much more disruptive campaigns from unfolding tomorrow.
Read more »
trending news
CloudFlare cyber attack Cyber Attacks DDOS Attacks trending news

Cloudflare Blocks Largest DDoS Attack in History as Global Cyber Threats Surge

Cloudflare announced on Wednesday that it has detected and stopped the largest distributed denial of service (DDoS) attack ever recorded. 

The attack peaked at 29.7 terabits per second and lasted 69 seconds. The company said the traffic came from a botnet-for-hire called AISURU, which has been behind several extreme DDoS incidents over the past year. Cloudflare did not reveal the name of the targeted organization. 

AISURU has repeatedly targeted telecommunication companies, gaming platforms, hosting providers and financial services. 

Cloudflare said it also blocked another massive attack from the same botnet that reached 14.1 billion packets per second. Security researchers estimate that AISURU is powered by one to four million infected devices across the world. 

According to Cloudflare, the record-breaking event was a UDP carpet bombing attack that hit around 15,000 ports per second. The attackers randomised packet properties to get past defences, but Cloudflare’s automated systems detected and neutralised the traffic. Cloudflare has recorded 2,867 AISURU attacks since the beginning of 2025. 

Out of these, 1,304 hyper volumetric attacks happened in the third quarter of this year alone. In total, the company blocked 8.3 million DDoS attacks during the same period. That number is 15 percent higher than the previous quarter and 40 percent higher than the same period last year. 

So far in 2025, Cloudflare has mitigated 36.2 million DDoS attacks, and the year is not yet over. The company highlighted a rapid increase in network layer attacks, which now make up 71 percent of all recorded attacks. 

Meanwhile, HTTP DDoS attacks declined in comparison. The report also shows major changes in the global DDoS landscape. The number of attacks that went above 100 million packets per second jumped by 189 percent quarter over quarter. In addition, 1,304 attacks exceeded one terabit per second. 

Cloudflare noted that most attacks last for less than 10 minutes, which leaves very little time for manual intervention and can still cause long service disruptions. 

The list of attack sources is dominated by Asia. Indonesia has remained the world’s biggest source of DDoS attacks for an entire year, followed by other locations such as Thailand, Bangladesh, Vietnam, India, Hong Kong and Singapore. Ecuador, Russia and Ukraine make up the remaining top ten. 

Several industries have seen major increases in targeting. Attacks against the mining, minerals and metals sector rose sharply and pushed it to the 49th most attacked industry worldwide. The automotive industry experienced the largest jump and is now the sixth most attacked. 

DDoS attacks targeting artificial intelligence companies rose by 347 percent in September alone. Across all sectors, information technology and services faced the most attacks. Telecommunications, gambling, gaming and internet services were also among the hardest hit. 

The most attacked countries this year include China, Turkey, Germany, Brazil, the United States and Russia. Cloudflare said the scale and sophistication of current DDoS activity marks a turning point for global cybersecurity. 

The company warned that many organizations are struggling to keep up with attackers who now operate with far more power and speed than ever before.
Read more »
malware
cryptocurrency DanaBot DDOS Attacks Law Enforcement malware

DanaBot Malware Network Disrupted After Researchers Discover Key Flaw

 



In a major breakthrough, cybersecurity experts uncovered a major weakness in the DanaBot malware system that ultimately led to the disruption of its operations and criminal charges against its operators.

DanaBot, which has been active since 2018, is known for being sold as a service to carry out cybercrimes like banking fraud, stealing personal information, carrying out remote attacks, and launching distributed denial-of-service (DDoS) attacks. The malware remained a persistent threat until recent enforcement actions successfully targeted its infrastructure.


Discovery of the DanaBot Weakness

Researchers from Zscaler’s ThreatLabz team identified a serious flaw in DanaBot’s system in a version released in June 2022. This flaw, later called "DanaBleed," exposed the internal workings of the malware to security professionals without the attackers realizing it.

The issue stemmed from changes made to DanaBot’s communication system, known as the command and control (C2) protocol. The updated system failed to properly handle random data in its responses, accidentally revealing leftover information stored in the malware’s memory.

Because of this memory leak, security experts were able to repeatedly collect sensitive fragments from DanaBot’s servers over time. This flaw is similar to the infamous HeartBleed vulnerability that affected OpenSSL in 2014 and caused serious security concerns worldwide.


What the Flaw Exposed

Through careful analysis, researchers were able to access highly valuable information, including:

• Details about the malware operators, such as usernames and IP addresses

• Locations of DanaBot’s servers and websites

• Stolen victim data, including login credentials

• Records of malware updates and internal changes

• Private cryptographic keys used for security

• Internal system logs and SQL database activity

• Parts of the malware’s management dashboard

For more than three years, DanaBot continued to operate with this hidden security hole, giving investigators a rare opportunity to quietly monitor the criminals and gather detailed evidence.


Law Enforcement Action

After collecting enough proof, international law enforcement teams launched a coordinated operation called "Operation Endgame" to shut down DanaBot’s network. This effort led to the takedown of key servers, the seizure of over 650 domains connected to the malware, and the recovery of nearly $4 million in cryptocurrency.

While the core group of attackers, mainly located in Russia, has been formally charged, no arrests have been reported so far. However, the removal of DanaBot’s infrastructure has significantly reduced the threat.


Final Thoughts

This case highlights the importance of careful cybersecurity monitoring and how even well-established criminal groups can be exposed by overlooked technical mistakes. Staying updated on the latest security research is essential, as malware groups often release new versions and fixes that may change the threat landscape quickly.

Read more »
Russia-Ukraine War
Cyber Attacks DDoS DDOS Attacks DDoS Threats Hacker attack Hacktivist group NCSC Pro-Russian Hackers Russia-Ukraine War

Russian Hacktivists Disrupt Dutch Institutions with DDoS Attacks

 

Several Dutch public and private organizations have experienced significant service outages this week following a wave of distributed denial-of-service (DDoS) attacks linked to pro-Russian hacktivists. The Netherlands’ National Cyber Security Center (NCSC), part of the Ministry of Justice, confirmed that the attacks affected multiple sectors and regions across the country.  

The NCSC disclosed that both government and private entities were targeted in what it described as large-scale cyber disruptions. While the full scope is still being assessed, municipalities and provinces including Groningen, Noord-Holland, Drenthe, Overijssel, Zeeland, Noord-Brabant, and cities like Nijmegen, Apeldoorn, Breda, and Tilburg reported that public portals were intermittently inaccessible. 

A pro-Russian threat group calling itself NoName057(16) has claimed responsibility for the cyberattacks through its Telegram channel. Though the NCSC did not confirm the motive, the group posted that the attacks were a response to the Netherlands’ recent €6 billion military aid commitment to Ukraine, as well as future support amounting to €3.5 billion expected in 2026. Despite the widespread disruptions, authorities have stated that no internal systems or sensitive data were compromised. 

The issue appears confined to access-related outages caused by overwhelming traffic directed at the affected servers — a hallmark of DDoS tactics. NoName057(16) has been a known actor in the European cybersecurity landscape since early 2022. It has targeted various Western governments and institutions, often in retaliation for political or military actions perceived as anti-Russian. The group also operates DDoSIA, a decentralized platform where users can participate in attacks in exchange for cryptocurrency payments. 

This model has enabled them to recruit thousands of volunteers and sustain persistent campaigns against European targets. While law enforcement in Spain arrested three alleged DDoSIA participants last year and confiscated their devices, key figures behind the platform remain unidentified and at large. The lack of major indictments has allowed the group to continue its operations relatively unimpeded. 

The NCSC has urged organizations to remain vigilant and maintain strong cybersecurity protocols to withstand potential follow-up attacks. With geopolitical tensions remaining high, experts warn that such politically motivated cyber operations are likely to increase in frequency and sophistication. 

As of now, restoration efforts are ongoing, and the government continues to monitor the digital landscape for further signs of coordinated threats.
Read more »
Vo1d
Android TV DDOS Attacks malware Vo1d

Malware Attack on Android TV Devices Affects Over 1.6 Million Users

 



Cybersecurity researchers have discovered a new form of malware that is spreading through Android TV devices across the globe. This malware, known as Vo1d, has already infected over 1.6 million devices, turning them into remote-controlled bots used for illegal activities without the owners’ knowledge.  

The Vo1d malware has existed for a while, but researchers at XLab recently identified a stronger, more advanced version that makes it harder to detect and remove. This upgraded variant has been designed to avoid being analyzed or controlled by cybersecurity experts, making it a serious concern for Android TV users.  


How the Vo1d Malware Works  

Once Vo1d malware enters an Android TV device, it secretly connects it to a network controlled by hackers, known as a botnet. This allows the attackers to control thousands of devices at once without the owners realizing it. These devices are then used to carry out illegal activities like DDoS attacks and ad click fraud.  

In a DDoS (Distributed Denial of Service) attack, a large number of devices flood a website or service with so many requests that it crashes, making it inaccessible. On the other hand, ad click fraud involves the infected devices automatically clicking on online ads, creating fake revenue for dishonest advertisers. Both of these activities can cause financial losses to companies and harm online platforms.  

The malware has been particularly active in countries like Argentina, Brazil, China, Indonesia, South Africa, and Thailand. However, since it is spreading rapidly, users in other countries should also remain cautious.  


Why This Malware Is Difficult to Detect  

One of the main challenges with the new Vo1d variant is that it uses advanced encryption methods, which prevent cybersecurity professionals from studying or controlling it. It also hides deep within the device’s system, making it nearly impossible for regular antivirus software to detect and remove it.  

This ability to stay hidden allows the malware to operate silently for long periods, allowing hackers to keep using the device for illegal purposes. As a result, users may remain unaware that their device has been compromised.  


How to Protect Your Android TV Device  

To reduce the chances of your Android TV being infected by Vo1d, consider following these precautionary steps:  

1. Buy From Trusted Sources: Always purchase Android TV devices from well-known brands or official retailers. Avoid buying from unknown sellers, as some devices may already be compromised before purchase.  

2. Update Regularly: Install all firmware and security updates provided by the device manufacturer. These updates often fix vulnerabilities that malware exploits.  

3. Download Apps Carefully: Only download apps from official platforms like the Google Play Store. Avoid installing apps from third-party websites, as they may carry hidden malware.  

4. Watch for Unusual Activity: If your Android TV starts slowing down, overheating, or using too much data without reason, it may be infected. In such cases, reset your device and consider installing a trusted antivirus app.  

5. Secure Your Network: Make sure your home Wi-Fi has a strong password and activate firewall settings to reduce the chances of remote attacks.    


The rapid spread of Vo1d malware has raised concern among cybersecurity experts. With over 1.6 million devices already infected, users need to stay alert and take protective measures. By purchasing devices from verified sources, keeping software updated, and avoiding untrusted apps, users can reduce their risk of falling victim to such malware attacks.  

Staying informed about new threats and remaining cautious with device usage is the best way to keep your Android TV safe from harmful malware like Vo1d.

Read more »
Telecom
Beeline Cyber Attacks DDOS Attacks Internet Russia Telecom

Russian Telecom Company "Beeline" Hit, Users Face Internet Outage

Russian Telecom Company "Beeline" Hit, Users Face Internet Outage

Internet outage in, telecom provider attacked

Users in Russia faced an internet outage in a targeted DDoS attack on Russian telecom company Beeline. This is the second major attack on the Moscow-based company in recent weeks; the provider has over 44 million subscribers.

After several user complaints and reports from outage-tracking services, Beeline confirmed the attack to local media.

According to Record Media, internet monitoring service Downdetector’s data suggests “most Beeline users in Russia faced difficulties accessing the company’s mobile app, while some also reported website outages, notification failures and internet disruptions.” 

Impact on Beeline

Beeline informed about the attack on its Telegram channel, stressing that the hacker did not gain unauthorized access to consumer data. Currently, the internet provider is restoring all impacted systems and improving its cybersecurity policies to avoid future attacks. Mobile services are active, but users have cited issues using a few online services and account management features.

Rise of threat in Russia

The targeted attack on Beeline is part of a wider trend of cyberattacks in Russia; in September 2024, VTB, Russia’s second-largest bank, faced similar issues due to an attack on its infrastructure. 

These attacks highlight the rising threats posed by cyberattacks cherry-picking critical infrastructures in Russia and worldwide.

Experts have been warning about the rise in intensity and advanced techniques of such cyberattacks, damaging not only critical businesses but also essential industries that support millions of Russian citizens. 

Telecom companies in Russia targeted

How Beeline responds to the attack and recovers will be closely observed by both the telecom industry and regulators. The Beeline incident is similar to the attack on Russian telecom giant Megafon, another large-scale DDoS attack happened earlier this year. 

According to a cybersecurity source reported by Forbes Russia, the Beeline attack in February and the Megafon incident in January are the top hacktivist cyberattacks aiming at telecom sectors in 2025. 

According to the conversation with Forbes, the source said, “Both attacks were multi-vector and large-scale. The volume of malicious traffic was identical, but MegaFon faced an attack from 3,300 IP addresses, while Beeline was targeted via 1,600, resulting in a higher load per IP address.”

Read more »
Password
Cyber Crime Data Breach DDOS Attacks IoT Password

Huge Data Leak Puts 2.7 Billion Records at Risk – What You Should Know

 



A security issue has surfaced involving an unprotected database linked to Mars Hydro, a Chinese company known for making smart devices like LED grow lights and hydroponic equipment. Security researcher Jeremiah Fowler discovered this database was left open without a password, exposing nearly 2.7 billion records.


What Data Was Leaked?  

The database contained sensitive details, including WiFi network names, passwords, IP addresses, and device identifiers. Although no personal identity information (PII) was reportedly included, the exposure of network details still presents serious security risks. Users should be aware that cybercriminals could misuse this information to compromise their networks.


Why Is This Dangerous?  

Many smart devices rely on internet connectivity and are often controlled through mobile apps. This breach could allow hackers to infiltrate users’ home networks, monitor activity, or launch cyberattacks. Experts warn that leaked details could be exploited for man-in-the-middle (MITM) attacks, where hackers intercept communication between devices. 

Even though there’s no confirmation that cybercriminals accessed this database, IoT security remains a growing concern. Previous reports suggest that 57% of IoT devices have critical security weaknesses, and 98% of data shared by these devices is unencrypted, making them prime targets for hackers.


Rising IoT Security Threats  

Cybercriminals often target IoT devices, and botnet attacks have increased by 500% in recent years. Once a hacker gains access to a vulnerable device, they can spread malware, launch large-scale Distributed Denial-of-Service (DDoS) attacks, or infiltrate critical systems. If WiFi credentials from this breach fall into the wrong hands, attackers could take control of entire networks.


How Can Users Protect Themselves?  

To reduce risks from this security lapse, users should take the following steps:

1. Update Device Passwords: Many IoT gadgets use default passwords that are the same across multiple devices. Changing these to unique, strong passwords is essential.

2. Keep Software Up-to-Date: Manufacturers release software patches to fix security flaws. Installing these updates regularly reduces the risk of exploitation.

3. Monitor Network Activity: Watch for unusual activity on your network. Separating IoT devices from personal computers and smartphones can add an extra layer of security.

4. Enhance Security Measures: Using encryption tools, firewalls, and network segmentation can help defend against cyberattacks. Consider investing in comprehensive security solutions for added protection.


This massive data leak stresses the importance of IoT security. Smart devices provide convenience, but users must stay proactive in securing them. Understanding potential risks and taking preventive measures can help safeguard personal information and prevent cyber threats.



Read more »
VoIP Servers
Cyber Security DDOS Attacks Proxy Server Threat Landscape VoIP Servers

Understanding VoIP DDoS Attacks: Prevention and Mitigation Strategies

 


A distributed denial-of-service (DDoS) attack targets a VoIP server by overwhelming it with phony user requests. This excessive traffic can exceed the network’s capacity, causing service disruptions and making genuine user requests unprocessable. Online criminals exploit these attacks to disrupt Voice Over Internet Protocol (VoIP) network services, the backbone of modern business phone systems and customer service software. VoIP services are particularly susceptible to DDoS attacks, as even a failed attempt can significantly degrade voice call quality and reliability. 
  
Modus Operandi of VoIP DDoS Attacks 
 
DDoS attacks aim to overwhelm a network with fake traffic, resulting in service denial for legitimate users. A typical VoIP server managing hundreds of calls per hour might struggle to respond to thousands of requests per second during an attack. Key attack methods include:
  • Botnets: Hackers deploy large networks of compromised devices, such as PCs, routers, mobile phones, and IoT devices, to generate attack traffic.
  • SIP Flood Attack: The attacker sends numerous Session Initiation Protocol (SIP) call requests, crashing the victim's VoIP server.
  • SIP Reflection Attack: Hackers spoof the victim's IP address and send queries to random servers, which flood the victim’s server with responses, overloading it.
Mitigation Tips to Defend Against VoIP DDoS Attacks 
 
Adopting robust defense mechanisms can help protect VoIP systems from DDoS attacks. Key strategies include: 
  
1. Use a Reverse Proxy A reverse proxy acts as an intermediary between clients and servers, handling and filtering requests to shield the server. Benefits include:
  • Regulating inbound traffic to ensure only legitimate requests pass through.
  • Disguising the origin server's IP address to prevent direct targeting by hackers.
  • Minimizing latency by offloading tasks such as encrypting and decrypting TLS/SSL communications.
2. Real-Time Network Monitoring Real-time monitoring tools establish a baseline of regular activity to detect anomalies. These tools:
  • Identify unusual network behavior, enabling rapid responses to DDoS-induced traffic spikes.
  • Protect endpoint protocols and IP blocks from malicious requests.
  • Help prevent VoIP fraud by detecting and mitigating suspicious activities.
3. Implement Rate Limiting Rate limiting reduces the impact of malicious bot traffic by controlling the volume of requests. It works by:
  • Delaying or blocking excessive requests from a single IP or multiple sources.
  • Setting thresholds to limit the frequency of actions within a specific time frame.
  • Ensuring only legitimate traffic reaches critical resources.
Rate limiting effectively curtails attackers' ability to sustain a successful DDoS attack. 

VoIP DDoS attacks pose significant risks to modern communication systems, but proactive measures can mitigate these threats. By using reverse proxies, adopting real-time monitoring tools, and implementing rate-limiting techniques, organizations can safeguard their VoIP infrastructure against malicious traffic and ensure uninterrupted services.
Read more »
Vulnerabilities and Exploits
Botnet Cyberattacks CyberCrime Cybersecurity CyberThreat Cyberthreats DDOS Attacks IoT Vulnerabilities and Exploits

Understanding and Preventing Botnet Attacks: A Comprehensive Guide

 


Botnet attacks exploit a command-and-control model, enabling hackers to control infected devices, often referred to as "zombie bots," remotely. The strength of such an attack depends on the number of devices compromised by the hacker’s malware, making botnets a potent tool for large-scale cyberattacks.

Any device connected to the internet is at risk of becoming part of a botnet, especially if it lacks regular antivirus updates. According to CSO Online, botnets represent one of the most significant and rapidly growing cybersecurity threats. In the first half of 2022 alone, researchers detected 67 million botnet connections originating from over 600,000 unique IP addresses.

Botnet attacks typically involve compromising everyday devices like smartphones, smart thermostats, and webcams, giving attackers access to thousands of devices without the owners' knowledge. Once compromised, these devices can be used to launch spam campaigns, steal sensitive data, or execute Distributed Denial of Service (DDoS) attacks. The infamous Mirai botnet attack in October 2016 demonstrated the devastating potential of botnets, temporarily taking down major websites such as Twitter, CNN, Reddit, and Netflix by exploiting vulnerabilities in IoT devices.

The Lifecycle of a Botnet

Botnets are created through a structured process that typically involves five key steps:

  1. Infection: Malware spreads through phishing emails, infected downloads, or exploiting software vulnerabilities.
  2. Connection: Compromised devices connect to a command-and-control (C&C) server, allowing the botmaster to issue instructions.
  3. Assignment: Bots are tasked with specific activities like sending spam or launching DDoS attacks.
  4. Execution: Bots operate collectively to maximize the impact of their tasks.
  5. Reporting: Bots send updates back to the C&C server about their activities and outcomes.

These steps allow cybercriminals to exploit botnets for coordinated and anonymous attacks, making them a significant threat to individuals and organizations alike.

Signs of a Compromised Device

Recognizing a compromised device is crucial. Look out for the following warning signs:

  • Lagging or overheating when the device is not in use.
  • Unexpected spikes in internet usage.
  • Unfamiliar or abnormal software behavior.

If you suspect an infection, run a malware scan immediately and consider resetting the device to factory settings for a fresh start.

How to Protect Against Botnet Attacks

Safeguarding against botnets doesn’t require extensive technical expertise. Here are practical measures to enhance your cybersecurity:

Secure Your Home Network

  • Set strong, unique passwords and change default router settings after installation.
  • Enable WPA3 encryption and hide your network’s SSID.

Protect IoT Devices

  • Choose products from companies that offer regular security updates.
  • Disable unnecessary features like remote access and replace default passwords.

Account Security

  • Create strong passwords using a password manager to manage credentials securely.
  • Enable multi-factor authentication (MFA) for an added layer of security.

Stay Updated

  • Keep all software and firmware updated to patch vulnerabilities.
  • Enable automatic updates whenever possible.

Be Wary of Phishing

  • Verify communications directly with the source before providing sensitive information.
  • Avoid clicking on links or downloading attachments from untrusted sources.

Use Antivirus Software

  • Install reputable antivirus programs like Norton, McAfee, or free options like Avast.

Turn Off Devices When Not in Use

  • Disconnect smart devices like TVs, printers, and home assistants to minimize risks.

Organizations can mitigate botnet risks by deploying advanced endpoint protection, strengthening corporate cybersecurity systems, and staying vigilant against evolving threats. Implementing robust security measures ensures that businesses remain resilient against increasingly sophisticated botnet-driven cyberattacks.

Botnet attacks pose a serious threat to both individual and organizational cybersecurity. By adopting proactive and practical measures, users can significantly reduce the risk of becoming victims and contribute to a safer digital environment.

Read more »
Proxy Service
Cyber Security DDoS DDOS Attacks Free VPN IP Address Network Security Privacy Risks Proxy Service

Free VPN Big Mama Raises Security Concerns Amid Cybercrime Links

 

Big Mama VPN, a free virtual private network app, is drawing scrutiny for its involvement in both legitimate and questionable online activities. The app, popular among Android users with over a million downloads, provides a free VPN service while also enabling users to sell access to their home internet connections. This service is marketed as a residential proxy, allowing buyers to use real IP addresses for activities ranging from ad verification to scraping pricing data. However, cybersecurity experts warn of significant risks tied to this dual functionality. 

Teenagers have recently gained attention for using Big Mama VPN to cheat in the virtual reality game Gorilla Tag. By side-loading the app onto Meta’s Oculus headsets, players exploit location delays to gain an unfair advantage. While this usage might seem relatively harmless, the real issue lies in how Big Mama’s residential proxy network operates. Researchers have linked the app to cybercrime forums where it is heavily promoted for use in activities such as distributed denial-of-service (DDoS) attacks, phishing campaigns, and botnets. Cybersecurity firm Trend Micro discovered that Meta VR headsets are among the most popular devices using Big Mama VPN, alongside Samsung and Xiaomi devices. 

They also identified a vulnerability in the VPN’s system, which could have allowed proxy users to access local networks. Big Mama reportedly addressed and fixed this flaw within a week of it being flagged. However, the larger problem persists: using Big Mama exposes users to significant privacy risks. When users download the VPN, they implicitly consent to having their internet connection routed for other users. This is outlined in the app’s terms and conditions, but many users fail to fully understand the implications. Through its proxy marketplace, Big Mama sells access to tens of thousands of IP addresses worldwide, accepting payments exclusively in cryptocurrency. 

Cybersecurity researchers at firms like Orange Cyberdefense and Kela have linked this marketplace to illicit activities, with over 1,000 posts about Big Mama appearing on cybercrime forums. Big Mama’s ambiguous ownership further complicates matters. While the company is registered in Romania, it previously listed an address in Wyoming. Its representative, using the alias Alex A, claims the company does not advertise on forums and logs user activity to cooperate with law enforcement. Despite these assurances, the app has been repeatedly flagged for its potential role in cyberattacks, including an incident reported by Cisco Talos. 

Free VPNs like Big Mama often come with hidden costs, sacrificing user privacy and security for financial viability. By selling access to residential proxies, Big Mama has opened doors for cybercriminals to exploit unsuspecting users’ internet connections. This serves as a cautionary tale about the dangers of free services in the digital age. Users are advised to exercise extreme caution when downloading apps, especially from unofficial sources, and to consider the potential trade-offs involved in using free VPN services.
Read more »
Session Smart Routers
Cryptominers Cyber Security DDOS Attacks Default Passwords Juniper Networks Mirai malware router security Session Smart Routers

Juniper Networks Warns of Mirai Malware Threat to Routers with Default Passwords

 

Juniper Networks has issued a warning about a vulnerability in its Session Smart Routers, emphasizing the risk of Mirai malware infection if factory-set passwords are not changed.

Starting December 11, the company began receiving reports from customers about "suspicious behavior" on their devices. Upon investigation, Juniper identified a common factor: users had not updated the default login credentials.

A specific variant of the Mirai malware has been scanning for these routers, exploiting the unchanged passwords to infiltrate systems. Once infected, the devices were reportedly "subsequently used as a DDoS attack source" to bombard websites with excessive traffic. However, Juniper did not disclose the number of devices affected or the locations of the attacks.

According to Juniper, Mirai is capable of executing "a wide range of malicious activities" beyond DDoS attacks. Past cases have revealed its involvement in spreading cryptominers and enabling "click fraud" schemes that manipulate online advertising metrics.

To safeguard their devices, Juniper advises Session Smart Router users to implement strong, unique passwords immediately and to stay vigilant for unusual network activity. Signs to monitor include unexpected port scans, increased login attempts, and surges in outbound traffic.

"If a system is found to be infected, the only certain way of stopping the threat is by reimaging the system as it cannot be determined exactly what might have been changed or obtained from the device," the advisory states.

Juniper also notes that Mirai commonly targets connected devices like routers and cameras, often exploiting software vulnerabilities to spread. Using default credentials further simplifies the intrusion process, making it crucial to update them
Read more »
Telnet
Cyber Attacks DDOS Attacks Matrix Telecom Telnet

Could Your Device Be Caught in the Matrix Cyber Attack?

 



A recent report has outlined a large-scale cyberattack widely referred to as the Matrix campaign. This attack has put in jeopardy an estimated 35 million internet-connected devices across the globe. "This attack contributes to slowing down internet connections to homes and exposes businesses to data breaches, operational interruptions, and reputational damage among others," said Aqua Security's threat intelligence team.

The Matrix campaign is a threat that has been orchestrated by an actor called Matrix. The attack leverages vulnerabilities and weak security practices in the devices like home routers, surveillance cameras, and enterprise systems. According to experts, this attack signifies an emerging trend of IoT device and enterprise infrastructure targeting in order to build botnets for DDoS attacks.


How the Matrix Attack Works

They take advantage of the openly available hacking tools, poor passwords, and misconfiguration to enter devices. Methods used are brute-force attacks and exploitation of hardcoded default credentials such as "admin:admin" or "root:camera." Once a device is compromised, it joins a botnet—a network of hijacked devices that can be used to carry out large-scale cyber attacks like DDoS, overwhelming targets with traffic.

Matrix is not only targeting the home router but also, for instance, the Telecom equipment and server infrastructure are under attack through common protocols and applications such as Telnet, SSH, and Hadoop. Even software development life cycle servers are vulnerable to attack; it has proven an evolution of cybercrime through the exploitation of corporate vulnerabilities. 


A Cybercrime Evolution: Low Skills, Big Impact

The scariest part of the Matrix attack is that it seems to be the handiwork of a lone, somewhat novice hacker known as a "script kiddie." This attacker, with the aid of widely available AI tools and ready-to-use hacking software, has mounted an unprecedented campaign around the globe.

According to Aqua Security, this attack highlights the ease with which low-skilled hackers can now execute sophisticated attacks, underscoring the growing danger of poorly secured devices.  


How to Protect Yourself

To safeguard your devices from becoming part of a botnet, it is essential to take the following precautions:  

1. Update Firmware: Ensure your router and other devices run the latest software updates.

2. Strengthen Passwords: Replace default credentials with strong, unique passwords. 

3. Secure Access: Where possible, use additional security measures such as two-factor authentication.


Having addressed these vulnerabilities, the users can secure their devices from further attacks. The Matrix campaign reminds everyone that in today's networked world, proper cybersecurity is essential.


Read more »
Subscribe to: Posts (Atom)