CySecurity News - Latest Information Security and Hacking Incidents: VPN

Cyber Security CyberCrime CyberThreat Public Wifi safeguard TVS VPN WiFi Wireless

Approaches Users Can Implement to Safeguard Wireless Connections

The Wi-Fi network is a wireless gateway that connects homes and businesses to the Internet via the air, and it is typically provided by a router, which transmits data signals across the network. Mobile devices, laptops, and tablets can access online services using this signal without the need for physical cables. However, if these networks are not properly protected by passwords, they are vulnerable to unauthorised access.

The internet can be accessed by any device within range, regardless of whether it belongs to the homeowner, a guest, or an unknown third party. While wireless internet has many advantages over the internet, it also presents significant security risks, and wireless internet is no exception. If an insecure network is in place, nearby users might be able to see users' online activities, and this could lead to an exposure of their personal information to unauthorised sources.

Moreover, when malicious actors exploit open networks to engage in illegal activities, such as spreading spam or accessing prohibited content, they may be held accountable by the network's registered owner. These risks underscore why Wi-Fi connections need to be securely protected with robust protection measures to prevent these threats from occurring.

Understanding Wi-Fi Technology and Its Security Implications

There is a widespread use of a wireless networking technology called Wi-Fi that allows devices such as smartphones, laptops, tablets, and computers to connect to the internet without using physical cables at all. It is important to understand that wireless routers are currently the most common way that internet connections are made, serving as a central hub for all Wi-Fi-enabled devices within a range to receive internet access.

Despite the popular belief that Wi-Fi is an acronym, the actual term "Wi-Fi" is a trademark created by a marketing firm for commercial purposes to promote wireless network certification standards. Essentially, the principle behind Wi-Fi is that data is transmitted through radio waves in the form of a signal. To minimise network congestion and reduce signal interference, it uses two radio frequency bands — usually 2.4 GHz and 5 GHz — that are divided into channels so that signal interference can be minimised.

A device that attempts to connect to a wireless network transmits data in binary form (the fundamental language used by computers) by using these radio waves when it attempts to connect. Upon receiving this data, the router relays it through a physical internet connection, such as a broadband cable, which establishes a connection with the online servers. End users can gain seamless access to the web virtually instantaneously, which allows them to access the web seamlessly.

As much as Wi-Fi is popular, it can also expose a network to potential vulnerabilities, as well as its convenience. The security of unsecured networks and poorly configured networks can lead to unauthorised access, data theft, or surveillance by unauthorised users. If an internet connection extends beyond the boundaries of a property—also known as a "signal footprint"—it becomes available for use by anyone nearby, including potentially malicious individuals.

Depending on the actor, network traffic may be intercepted, credentials may be captured, or even devices may be taken over if they are connected to the network. Users must manage their Wi-Fi settings and ensure that they are secure to reduce these risks. Several basic practices can be employed to improve digital safety and prevent intrusions, including monitoring connected devices, adjusting router configurations, and minimising signal exposure.

In the past, home security has always been viewed in terms of physical safeguards like door locks, alarms, and surveillance cameras; however, as everyday life becomes increasingly digital, the protection of a household's online presence has become equally important. The risk of a cyber-attack on a home Wi-Fi network that is not secured poses a serious cybersecurity threat, but it often goes unnoticed. If cybercriminals are not adequately protected, they are capable of exploiting network vulnerabilities to gain unauthorised access.

In these cases, the attacker may install malicious software, intercept confidential information like credit card numbers, or even gain access to live camera feeds that compromise both privacy and safety. In extreme cases, attackers may install malicious software, intercept credit card information, or even hijack connected devices. To mitigate these risks, it is crucial to strengthen the security of users' home Wi-Fi networks.

As a result of a properly secured network, users reduce the possibility of unauthorised access, prevent sensitive data from being exploited, and act as a barrier against hackers. As well as protecting the homeowner's digital footprint, it ensures that only trusted users and devices can access the internet, thus preserving speed and bandwidth and protecting the homeowner's digital footprint.

In today's connected world, robust Wi-Fi security is no longer optional—it is now an integral part of modern home security.

Configuring a Wi-Fi network to maximise security is an essential step.

It is important to remember that in addition to adopting general security habits, configuring the router correctly is also an important part of maintaining a reliable and secure wireless network. Numerous key measures are often overlooked by users but are essential in preventing unauthorised access to personal data.

Set up strong network encryption.

To keep Wi-Fi communication secure, all modern routers should support WPA3 Personal, which is the industry standard that offers enhanced protection from brute force attacks and unauthorised interceptions. When this standard is not available, there is always the possibility of using WPA2 Personal, which is a strong alternative to WPA3. In the case of older routers, users who have not updated their firmware or have not replaced their router hardware should take note that outdated protocols like WEP and WPA are no longer enough to provide safe and secure connections.

Change the default router credentials immediately.

The router manufacturer usually assigns a default username, password, and network name (SSID) to its routers, which information is widely available online, and which can be easily exploited. By replacing these default credentials with unique, complex ones, unauthorised access risk is significantly reduced. In addition to the password used by devices to connect to the Wi-Fi network, the router's administrative password is used to manage the router's settings.

Maintain an up-to-date firmware.

Keeping the router software or firmware up-to-date is one of the most important aspects of keeping it secure. If users intend to configure a new router or make changes, they should visit the manufacturer's website to verify the latest firmware version.

When users register their routers with the manufacturer and choose to receive updates, they are assured to be informed about critical patches promptly. Users of routers provided by Internet Service Providers (ISPS) should verify whether the updates are automatically handled or if they need to be manually performed.

Disable High-Risk Features by Default

There is no denying that certain convenience features, such as Remote Management, Wi-Fi Protected Setup (WPS), and Universal Plug and Play (UPnP), can introduce security weaknesses. Though they simplify the process of connecting devices to a network, they are vulnerable to malicious actors if left active for extended periods. To minimise the potential for attack surfaces, these functions should be disabled during initial setup.

Establish a Segmented Guest Network

The guest network is a unique way of enabling visitors to use the internet without gaining access to the main network or its connected devices by creating a separate guest network. This segmentation minimises the chance that a guest device could be compromised unintentionally by malware or spyware. Assigning a separate network name and password to the guest network reinforces this layer of isolation, so the guest network doesn't get compromised by the main network.

The administrator should log out and lock down access to the system.

To prevent unauthorised changes to users' router settings, it is important to log out of the administrative interface after they have configured it. Leaving the administrative interface logged in increases the probability of accidental or malicious changes being made. There are other measures in place to protect their router.

Turn on the router's built-in firewall.

In most modern routers, a built-in firewall prevents malicious traffic from reaching connected devices, as it filters suspicious traffic before it reaching the device. A router’s firewall can provide additional protection against malware infections, intrusion attempts, and other cyber threats. Users need to verify that the firewall is active in the router’s settings.

Keep all connected devices secure.

A network's security is just one part of the equation. All connected devices, including laptops, smartphones, smart TVS, and Internet of Things appliances, should be updated with the latest software and protected by anti-virus or anti-malware software. In most cases, an intruder can gain access to a larger network using a compromised device.

With a blurring of the lines between the physical and digital worlds and the ongoing blurring of the boundaries in which they exist, protecting users' home or office Wi-Fi network has become not just an issue of convenience but a necessity as well. Cybersecurity threats are on the rise, often targeting vulnerabilities within household networks that have been overlooked.

As a precautionary measure to protect personal data, maintain control over bandwidth, and maintain digital privacy, users need to take a proactive, layered approach to wireless security, so that they can protect themselves against unauthorised access. As well as updating firmware, restricting access, monitoring device activity, and disabling exploitable features, it is crucial that users go beyond default settings.

Users can create a resilient digital environment by treating Wi-Fi networks in the same manner as physical home security systems do—one that is resistant to intrusion, protects sensitive information, and guarantees uninterrupted, safe connectivity. By doing this, users can build a resilient digital environment. When it comes to protecting themselves against emerging cyber threats, it remains paramount to stay informed and vigilant about the latest developments in technology.

Switzerland’s New Law Proposal Could Put VPN Privacy at Risk



 

VPN

Companies Online Services Privacy Switzerland VPN

Switzerland’s New Law Proposal Could Put VPN Privacy at Risk

Switzerland is thinking about changing its digital surveillance laws, and privacy experts are worried. The new rules could force VPN companies and secure messaging services to track their users and give up private information if requested.

At the center of the issue is a proposed change that would expand government powers over online services like email platforms, messaging apps, VPNs, and even social media sites. These services could soon be required to collect and store personal details about their users and hand over encrypted data when asked.

This move has sparked concern among privacy-focused companies that operate out of Switzerland. If the law is approved, it could prevent them from offering the same level of privacy they are known for.

What Could the New Rules Mean?

The suggested law says that if a digital service has over 5,000 users, it must collect and verify users’ identities and store that information for half a year after they stop using the service. This would affect many platforms, even small ones run by individuals or non-profits.

Another part of the law would give authorities the power to access encrypted messages, but only if the company has the key needed to unlock them. This could break the trust users have in these services, especially those who rely on privacy for safety or security.

Why VPN Providers Are Speaking Out

VPN services are designed to hide user activity and protect data from being tracked. They usually don’t keep any records that could identify a user. But if Swiss law requires them to log personal data, that goes against the very idea of privacy that VPNs are built on.

Swiss companies like Proton VPN, Threema, and NymVPN are all worried. They say the law could damage Switzerland’s reputation as a country that supports privacy and secure digital tools.

NymVPN’s Warning

NymVPN, a newer VPN service backed by privacy activist Chelsea Manning, has raised strong objections. Alexis Roussel, the company’s Chief Operating Officer, explained that the new rules would not only hurt businesses but could also put users in danger—especially people in sensitive roles, like journalists or activists.

Roussel added that this law may try to go around earlier court rulings that protected privacy rights, which could hurt Switzerland’s fast-growing privacy tech industry.

What People Can Do

Swiss citizens have time to give feedback on the proposal until May 6, 2025. NymVPN is encouraging people to spread the word, take part in the consultation process, and contact government officials to share their concerns. They’re also warning people in other countries to stay alert in case similar ideas start appearing elsewhere.

Firewalls and VPNs Under Siege as Businesses Report Growing Cyber Intrusions



 

zero Day vulnerability

Cyber intrusion Cyber Security CyberThreat DDoS FortiGate IoT IP Address Networkk Infrastructure ransomware-as-a-service (RaaS) VPN Vulnerabilities Firewalls zero Day vulnerability

Firewalls and VPNs Under Siege as Businesses Report Growing Cyber Intrusions

A security researcher has discovered an ongoing cyberattack that is active, exploiting a newly discovered vulnerability in Fortinet's FortiGate Firewalls to infiltrate corporate and enterprise networks and has been conducting this activity for some time. A security advisory published on Tuesday by Fortinet confirmed the existence of the critical security flaw known as CVE-2024-55591 and indicated that the vulnerability is currently being exploited in the wild.

Nevertheless, cybersecurity experts are voicing their concerns over the possibility that malicious actors are exploiting this flaw as a zero-day vulnerability - a term that refers to a software vulnerability exploited before the vendor is made aware of or has issued a patch for it. According to a report by Fortinet, attackers may have actively targeted this vulnerability since at least December, many months before it was publicly disclosed and patched.

In particular, organisations that heavily rely on FortiGate Firewalls for perimeter defence face a significant threat when the vulnerability is exploited by exploiting CVE-2024-55591. As a result of the vulnerability's criticality, enterprises should apply security updates as soon as possible and examine their systems for any indications of unauthorized access as soon as possible. Even though zero-day exploits remain a threat, this development highlights the fact that cybercriminals are increasingly focusing on foundational network infrastructure to gain a foothold in high-value environments.

The use of virtual private networks (VPNs) as a critical defence mechanism against a variety of cyber threats has long been regarded as a crucial aspect of protecting digital communications from a wide range of threats. VPNs are effective in neutralising the risks associated with man-in-the-middle attacks, which involve unauthorised parties trying to intercept or manipulate data while it is in transit by encrypting the data transmissions. Through this layer of encryption, sensitive data remains secure, even across unsecured networks.

One of the most prominent use cases for VPNs is that they serve the purpose of protecting people using public Wi-Fi networks, which are often vulnerable to unauthorised access. It has been shown that VPNs are significantly less likely to expose or compromise data in such situations because they route traffic through secure tunnels. Additionally, VPNs hide the IP addresses of users, thereby providing greater anonymity to users and reducing the possibility of malicious actors tracking or monitoring them.

As a result of this concealment, network resources are also protected against distributed denial-of-service (DDoS) attacks, which often use IP addresses as a method of overloading network resources. Even though VPNs have been around for decades, their use today does not suffice as a standalone solution due to the increasingly complex threat landscape that exists in today's society. To ensure comprehensive protection against increasingly sophisticated attack vectors, it is important to integrate their capabilities with more advanced, adaptive cybersecurity measures.

It seems that conventional security frameworks, such as Firewalls and VPN,s are becoming increasingly outpaced as the cybersecurity landscape continues to evolve due to the sophistication and frequency of modern threats, which have increased significantly over the past few years. Businesses across many industries are experiencing an increasing number of breaches and vulnerabilities, and traditional methods of addressing these vulnerabilities are no longer capable of doing so.

Due to the widespread transition from on-premises infrastructure to remote and digitally distributed work environments, legacy security architectures have become increasingly vulnerable, forcing enterprises to reassess and update their defence strategies. Firewalls and VPNs were once considered to be the cornerstones of enterprise network security; however, in today's increasingly complex threat environment, they are having trouble meeting the demands.

In the past, these technologies have played an important role in securing organisational boundaries, but today, the limitations of those technologies are becoming increasingly apparent as organisations transition to a cloud-based environment and undergo rapid digital transformation. In the year 2025, technological advances are expected to change the way industry operations are conducted—for instance, the adoption of generative artificial intelligence, automation, and the proliferation of Iot and OT systems.

Despite these innovations, there are also unprecedented risks associated with them. For example, malicious actors use artificial intelligence to automate spear-phishing efforts, craft highly evasive malware, and exploit vulnerabilities more quickly and accurately than they could previously. In addition, as Ransomware-as-a-Service (Raas) is on the rise, the barrier to entry for hackers is dropping, enabling a broader set of threat actors to conduct sophisticated, scalable attacks on businesses. To respond effectively to the complexities of a digitally driven world, organisations must adopt proactive, adaptive cybersecurity models that are capable of responding to the challenges of this dynamic threat environment and moving beyond legacy security tools.

There has been a significant shift in cybersecurity dynamics that has led to a worrying trend: malicious actors are increasingly exploiting Virtual Private Networks (VPNs) as a strategy to gain an advantage over their adversaries. Since VPNs were originally developed as a way to enhance privacy and protect data, they are increasingly being repurposed by cybercriminals to facilitate complex attacks while masking their identity digitally. Because VPNs are dual-purpose devices, they have become instruments of exploitation, which poses a significant challenge for cybersecurity professionals as well as digital forensics teams to deal with.

There is one particularly alarming technique for using VPN software to exploit vulnerabilities, which involves deliberately exploiting these vulnerabilities to bypass perimeter defences, infiltrate secure systems, and deploy malware without being it. When attackers identify and target these vulnerabilities, they can easily bypass perimeter defences, infiltrate secure systems, and deploy malware without being detected.

Frequently, such breaches act as entry points into larger campaigns, such as coordinated phishing campaigns that attempt to trick individuals into revealing confidential information. Further, VPNs are known for the ability to mask the actual IP addresses of threat actors, a technique known as IP address masquerading, which enables them to evade geographical restrictions, mislead investigators, and remain anonymous when they launch cyberattacks.

In addition to enabling adversaries to circumvent Firewalls, VPNs also offer the option of encrypting and tunnelling, thus enabling them to penetrate networks that would otherwise be resistant to unauthorised access with greater ease. As a matter of fact, VPNs are often used as a means of spreading malicious software across unreliable networks. By using an encrypted VPN traffic, malware can be able to bypass traditional detection methods, thereby circumventing traditional detection methods. The shield of anonymity provided by VPNs can also be used by threat actors to impersonate legitimate organisations and initiate phishing campaigns, compromising the privacy and integrity of users.

VPNs can also facilitate the spreading of Distributed Denial-of-Service (DDoS) attacks, which is equally troubling. As these networks are anonymised, it makes it difficult to trace the origin of such attacks, which hinders the development of appropriate response strategies and mitigation strategies. This paradox underscores the complexity of modern cybersecurity, since one security tool can serve both as a tool for cybercrime and a tool for security.

Even though VPNs remain an important tool to keep users safe and anonymous, their misuse requires a proactive and multifaceted response. To combat this misuse, people need robust technological defences combined with ongoing awareness and education initiatives, which will help us address this misuse effectively. Only through such comprehensive measures can organisations ensure the integrity of VPN technology and ensure trust in the digital privacy infrastructure as long as the technology remains intact.

Check Point has issued a formal warning regarding the active targeting of its VPN devices as part of an ongoing increase in cyber threats against enterprise infrastructure. As a result of this disclosure, people have been reminded again that there is a sustained campaign aimed at compromising remote access technologies and critical network defences. It is the second time in recent months that a major cybersecurity vendor has released such an alert in the past couple of months.

According to Cisco, in April 2024, organisations are being warned about a widespread wave of brute-force attacks against VPNs and Secure Shell (SSH) services that are likely to impact several devices from Cisco, Check Point, SonicWall, Fortinet, and Ubiquiti, among others. In the first observed attack around March 18, attackers used anonymised tools, such as TOR exit nodes, proxy networks, and other techniques to obfuscate and avoid detection and block lists, to launch the attacks.

In March of this year, Cisco had also noticed that passwords were being sprayed at their Secure Firewall appliances that were running Remote Access VPN (RAVPN) services. According to analysts, this is a reconnaissance phase, likely intended to lay the groundwork for more advanced intrusions to follow. Following a subsequent analysis by cybersecurity researcher Aaron Martin, these incidents were linked to a malware botnet dubbed "Brutus", which was previously undocumented.

Over 20,000 IP addresses were found to be associated with this botnet that was deployed from both residential and cloud-hosted environments, which greatly complicated the process of attribution and mitigation. The threat landscape has only been compounded by Cisco's announcement that a state-sponsored hacker group, also known as UAT4356, has been utilising zero-day vulnerabilities found within its Firepower Threat Defence (FTD) and Adaptive Security Appliances to exploit zero-day vulnerabilities.

Known by the codename ArcaneDoor, the cyber-espionage campaign has been ongoing since November 2023, targeting critical infrastructure networks as well as governments around the world as part of a broader cyber-espionage campaign. As the frequency and complexity of cyber attacks continue to increase, it is apparent that legacy perimeter defences are no longer adequate in terms of security.

A layered, intelligence-driven approach to security includes detecting threats in real time, hardening systems continuously, and responding to incidents in a proactive manner. As well as strengthening cybersecurity resilience, fostering collaboration between public and private sectors, sharing threat intelligence, and providing ongoing training to employees can make sure that they remain ahead of their adversaries. There is no doubt that the future of secure enterprise operations is going to be determined by the ability to anticipate, adapt, and remain vigilant in this rapidly evolving digital age.

Increasing Exploitation of Remote Access Tools Highlights Ransomware Risks



 

VPN

At-Bay Cyber Security CyberCrime Cyberhackers CyberThreat Digital Threat RaaS Ransomware remote access VPN

Increasing Exploitation of Remote Access Tools Highlights Ransomware Risks

Among the latest findings from cybersecurity insurance provider At-Bay, ransomware incidents witnessed a significant resurgence in 2024, with both the frequency and the severity of these attacks escalating significantly. Based on the firm's 2025 InsurSec Report, ransomware activity rose 20 percent from the previous year, returning to the high level of threat that had been experienced in 2021, when ransomware activity soared to 20 per cent.

There is an overwhelmingly large number of remote access tools and virtual private networks (VPNS) that have been exploited as entry points for these attacks, according to the report. In particular, mid-market organisations, particularly those with annual revenues between $25 million and $100 million, have been severely hit by this surge, with targeted incidents on the rise by 46 per cent. As a result of the At-Bay claims data, it is apparent that the severity of ransomware breaches has increased by 13 per cent year over year, highlighting how sophisticated and financially destructive these threats are becoming.

It was also found that attacks originating from third parties, such as vendors and service providers, have increased by 43 per cent, compounding the risk. It is also important to note that the economic toll of these supply chain-related incidents increased by 72 per cent on average, which increased the overall cost associated with them. This study highlights the need to reassess the cybersecurity postures of businesses, especially those that are reliant on remote access infrastructure, as well as strengthen defences across the entire digital ecosystem.

A study published by At-Bay highlights the widespread misuse of conventional cybersecurity tools, particularly those intended to enhance remote connectivity, as well as the deterioration of the effectiveness of traditional cybersecurity tools. Virtual private networks (VPNS) and remote access software, which are frequently deployed to ensure secure access to internal systems from off-site, are increasingly being repurposed as a gateway for malicious activities.

As a matter of fact, At-Bay’s analysis illustrates a concerning trend that threatens the flexibility of work environments. Threat actors are frequently exploiting these same tools to get access to corporate networks, extract sensitive data, and carry out disruptive operations. Due to their visibility on the public internet, cybercriminals are actively searching for potential vulnerabilities in these systems to attack them.

The Remote Access Tools are essentially a front door that provides access to your company's network and can typically be viewed by the general public. For that reason, remote access tools are prone to being attacked by attackers, according to Adam Tyra, Chief Information Security Officer for At-Bay's customer service department. In addition to this, the report highlights the disproportionately high risk posed by mid-sized enterprises, which generate annual revenue of between $25 million and $100 million.

The number of direct ransomware claims has increased significantly within the segment, which highlights both the increased exposure to cyber threats as well as the potential limitations in resources available to defend against them. As part of this report, the authors point out that “remote” ransomware activity has increased dramatically, a tactic that has gained considerable traction among threat actors over the past few years.

In 2024, this type of attack is expected to have increased by 50 per cent compared to the year before, representing an astounding 141 per cent increase since the year 2022. As far as traditional endpoint detection systems are concerned, remote ransomware campaigns are typically carried out by unmanaged or personal devices. In these kinds of attacks, rather than deploying a malicious payload directly onto the victim's machine, networks file-sharing protocols are used to access and encrypt data between connected systems by using the network file-sharing protocol. Therefore, the encryption process is often undetected by conventional security tools, such as malware scanners and behaviour-based defences.

These stealth-oriented methodologies pose a growing challenge to organizations, particularly small and medium-sized businesses (SMBS), as a result of this stealth-oriented methodology. In the study conducted by Sophos Managed Detection and Response (MDR), the most common threat vector in the SMB sector is ransomware and data exfiltration, which accounted for nearly 30 per cent of all cases tracked within this sector.

Even though sophisticated attack techniques are on the rise, the overall volume of ransomware-related events in 2024 saw a slight decline in volume compared with 2023 despite the rise in sophisticated attack techniques. There has been a marginal decrease in ransomware-as-a-service (Raas) incidents.

The advancement of defensive technologies and the dismantling of several of the most high-profile ransomware-as-a-service (Raas) operations have both contributed to this decline. This combined study emphasises the urgent need for businesses to modernise their cybersecurity strategies, invest in proactive threat detection, and strengthen the security of their remote access infrastructure to combat cybercrime.

With the development of ransomware tactics in complexity and scale, the resilience of organisations targeted by these threats has also evolved. As a result of these developments, organisations are increasingly expected to reevaluate their risk management frameworks to adopt a more proactive cybersecurity policy. To ensure that a robust defense strategy is implemented, it is imperative that remote access security systems are secured and access controls are implemented and advanced monitoring capabilities are deployed.

Besides raising awareness of cybersecurity throughout the workforce and fostering close cooperation between technology and insurance partners, it is also possible to significantly reduce the risk of ransomware being a threat to organisations. In the wake of cyber adversaries that keep improving their methods, businesses will have to take not only technical measures to strengthen their resilience, but also a wide range of strategic measures to anticipate and neutralise emergent attack vectors before they can cause significant damage.

Majority of Human-Operated Cyberattacks Target Domain Controllers, Warns Microsoft



 

VPN

Breach Cyber Security DomainControllers Hackers Ransomware Reconnaissance VPN

Majority of Human-Operated Cyberattacks Target Domain Controllers, Warns Microsoft

Microsoft has revealed that nearly 80% of human-operated cyberattacks involve compromised domain controllers, according to a recent blog post published on Wednesday. Alarmingly, in over 30% of these incidents, attackers use the domain controller—a central system in corporate IT networks—to spread ransomware across the organization.

A breached domain controller can give hackers access to password hashes for every user in the system. With these credentials, cybercriminals can identify and exploit privileged accounts, including those held by IT administrators. Gaining control of these accounts allows attackers to escalate their access levels.

"This level of access enables them to deploy ransomware on a scale, maximizing the impact of their attack," Microsoft stated.

One such attack, observed by the tech giant, involved a group known as Storm-0300. The hackers infiltrated a company’s systems by exploiting its virtual private network (VPN). After acquiring administrator credentials, they tried to access the domain controller through the remote desktop protocol (RDP). Once inside, they carried out a series of actions including reconnaissance, bypassing security measures, and escalating their privileges.

Despite the growing frequency of attacks, Microsoft emphasized the difficulty in protecting domain controllers due to their critical role in network management and authentication.

Defenders often face the challenge of “striking the right balance between security and operational functionality,” the blog noted.

To improve protection, Microsoft suggested enhancing domain controllers’ ability to differentiate between legitimate and malicious activity—an essential step toward minimizing server compromises.

Jason Soroko, senior fellow at cybersecurity firm Sectigo, stressed the importance of proactive security measures.

"Ultimately, even the most advanced defense mechanisms may falter if misconfigured or if legacy systems create vulnerabilities. Hence, vigilant customer-side security practices are critical to fortifying these systems against modern cyberthreats," Sectigo said.

While Microsoft offers strong protective tools, their success hinges on users maintaining up-to-date systems and activating features like multifactor authentication.

Chinese Cyber Espionage Suspected in New Ivanti VPN Malware Attack



 

Vulnerability

China Cybersecurity espionage Ivanti malware VPN Vulnerability

Chinese Cyber Espionage Suspected in New Ivanti VPN Malware Attack

A newly discovered cyberattack campaign targeting Ivanti VPN devices is suspected to be linked to a Chinese cyberespionage group. Security researchers believe the attackers exploited a critical vulnerability in Ivanti Connect Secure, which was patched by the Utah-based company in February. The attack is yet another example of how state-backed Chinese threat actors are rapidly taking advantage of newly disclosed vulnerabilities and frequently targeting Ivanti’s infrastructure.

On Thursday, researchers from Mandiant revealed that a group tracked as UNC5221 exploited a stack-based buffer overflow vulnerability to deploy malicious code from the Spawn malware ecosystem—an attack technique often associated with Chinese state-sponsored activity. Mandiant also identified two previously unknown malware families, which they've named Trailblaze and Brushfire. As seen in earlier attacks tied to Chinese hackers, this group attempted to manipulate Ivanti’s internal Integrity Checker Tool to avoid detection.

The vulnerability, officially tracked as CVE-2025-22457, was used to compromise multiple Ivanti products, including Connect Secure version 22.7R2.5 and earlier, the legacy Connect Secure 9.x line, Policy Secure (Ivanti’s network access control solution), and Zero Trust Access (ZTA) gateways. Ivanti released a patch for Connect Secure on February 11, emphasizing that Policy Secure should not be exposed to the internet, and that "Neurons for ZTA gateways cannot be exploited when in production."

Ivanti acknowledged the attack in a statement: "We are aware of a limited number of customers whose appliances have been exploited." The incident follows warnings from Western intelligence agencies about China's increasing speed and aggression in leveraging newly disclosed software vulnerabilities—often before security teams have time to deploy patches.

Many of the devices targeted were legacy systems no longer receiving software updates, such as the Connect Secure 9.x appliance, which reached end-of-support on December 31, 2024. Older versions of the Connect Secure product line, which were set to be replaced by version 22.7R2.6 as of February 11, were also compromised.

This marks the second consecutive year Ivanti has had to defend its products from persistent attacks by suspected Chinese state-backed hackers. Thursday’s advisory from Mandiant and Ivanti highlights a vulnerability separate from the one flagged in late March by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which had allowed attackers to install a Trojan variant linked to Spawn malware in Ivanti systems.

Apple and Google App Stores Host VPN Apps Linked to China, Face Outrage



 

VPN

Apple Data Privacy Data Regulation Google Internet Privacy VPN

Apple and Google App Stores Host VPN Apps Linked to China, Face Outrage

Google (GOOGL) and Apple (AAPL) are under harsh scrutiny after a recent report disclosed that their app stores host VPN applications associated with a Chinese cybersecurity firm, Qihoo 360. The U.S government has blacklisted the firm. The Financial Times reports that 5 VPNs still available to U.S users, such as VPN Proxy master and Turbo VPN, are linked to Qihoo. It was sanctioned in 2020 on the charges of alleged military ties.

Ilusion of Privacy: VPNs collecting data

In 2025 alone, three VPN apps have had over a million downloads on Google Play and Apple’s App Store, suggesting these aren’t small-time apps, Sensor Tower reports. They are advertised as “private browsing” tools, but the VPNs provide the companies with complete user data of their online activity. This is alarming because China’s national security laws mandate that companies give user data if the government demands it.

Concerns around ownership structures

The intricate web of ownership structures raises important questions; the apps are run by Singapore-based Innovative Connecting, owned by Lemon Seed, a Cayman Islands firm. Qihoo acquired Lemon Seed for $69.9 million in 2020. The company claimed to sell the business months late, but FT reports the China-based team making the applications were still under Qihoo’s umbrella for years. According to FT, a developer said, “You could say that we’re part of them, and you could say we’re not. It’s complicated.”

Amid outrage, Google and Apple respond

Google said it strives to follow sanctions and remove violators when found. Apple has removed two apps- Snap VPN and Thunder VPN- after FT contacted the business, claiming it follows strict rules on VPN data-sharing.

Privacy scare can damage stock valuations

What Google and Apple face is more than public outage. Investors prioritise data privacy, and regulatory threat has increased, mainly with growing concerns around U.S tech firms’ links to China. If the U.S government gets involved, it can result in stricter rules, fines, and even more app removals. If this happens, shareholders won’t be happy.

According to FT, “Innovative Connecting said the content of the article was not accurate and declined to comment further. Guangzhou Lianchuang declined to comment. Qihoo and Chen Ningyi did not respond to requests for comment.”

Experts Suggest Evolving Cyber Attacks Not Ending Anytime Soon



 

VPN

AI Cyber Attacks cyber resilience Internet phishing VPN

Experts Suggest Evolving Cyber Attacks Not Ending Anytime Soon

In a series of unfortunate events, experts suggest the advancement of cybercrime isn’t ending anytime soon.

Every day, the digital landscape evolves, thanks to innovations and technological advancements. Despite this growth, it suffers from a few roadblocks, cybercrime being a major one and not showing signs of ending anytime soon. Artificial Intelligence, large-scale data breaches, businesses, governments, and rising target refinement across media platforms have contributed to this problem. However, Nord VPN CTO Marijus Briedis believes, “Prevention alone is insufficient,” and we need resilience.

VPN provider Nord VPN experienced first-hand the changing cyber threat landscape after the spike in cybercrime cases attacking Lithuania, where the company is based, in the backdrop of the Ukraine conflict.

Why cyber resilience is needed

In the last few years, we have witnessed the expansion of cybercrime gangs and state-sponsored hackers and also the abuse of digital vulnerabilities. What is even worse is that “with little resources, you can have a lot of damage,” Briedis added. Data breaches reached an all-time high in 2024. The infamous “mother of all data breaches” incident resulted in a massive 26 billion record leak. Overall, more than 1 billion records were leaked throughout the year, according to NordLayer data.

Google’s Cybersecurity Forecast 2025 included Generative AI as a main threat, along with state-sponsored cybercriminals and ransomware.

Amid these increasing cyber threats, companies like NordVPN are widening the scope of their security services. A lot of countries have also implemented laws to safeguard against cyberattacks as much as possible throughout the years.

Over the years, governments, individuals, and organizations have also learned to protect their important data via vpn software, antivirus, firewall, and other security software. Despite these efforts, it’s not enough. According to Briedis, this happens because cybersecurity is not a fixed goal. "We have to be adaptive and make sure that we are learning from these attacks. We need to be [cyber] resilience."

The plan forward

In a RightsCon panel that Briedis attended, the discourse was aimed at NGOs, activists, and other small businesses, people take advantage of Nord’s advice to be more cyber-resilient. He gives importance to education, stressing it’s the “first thing.”

Black Basta's Slowdown Coincides with BlackLock's Growth



 

VPN

BackLock Black Basta Cyberhacekrs Cybersecurity CyberThreat malware Ransomware ransomware-as-a-service (RaaS) VBS VPN

Black Basta's Slowdown Coincides with BlackLock's Growth

The activity level of ransomware groups with "black" in their name has varied greatly over the early months of the new year. Despite the significant increase in attacks caused by the BlackLock ransomware group, the long-established Black Basta ransomware group appears to be about to break up, although it is still posing a persistent cybersecurity threat even so.

Even though BlackLock was first identified as a ransomware-as-a-service operation in March 2024, the cyber-criminals have been actively targeting multiple platforms in the past few months, including Windows, VMware ESXi, and Linux systems, according to a report by cybersecurity firm ReliaQuest. According to a report by ReliaQuest, BlackLock, also known as El Dorado or Eldorado, utilizes a double-extortion strategy, which involves exfiltration of sensitive data from a victim before the encryption of their computer systems.

With this approach, threat actors can demand a ransom in addition to the decryption of compromised files to obtain a promise that they will not reveal the stolen data once they have decrypted it. As reported by ReliaQuest, BlackLock has also reported a substantial increase in its activities over the last three months, with its data leak site registering fourteen times as many victims as it did in the previous three months of 2024. In light of this sharp increase, it is evident that BlackLock is becoming a greater threat to organizations, as it continues to expand its operations and refine its extortion tactics, which are becoming increasingly sophisticated.

To enhance an enterprise's cybersecurity posture, it is crucial to have a thorough understanding of the Black Basta attack methodologies. The Black Basta ransomware group attacks targeted organizations by exploiting known vulnerabilities, system misconfigurations, and inadequate security controls. It has been determined that the group systematically focused on exposed Remote Desktop Protocol servers, weak authentication mechanisms, malware droppers disguised as legitimate files, and exposed RDP servers through analyzing its internal communications.

In April 2022, blackBasta, a ransomware-as-a-service (RaaS) operation based in Russian, was first discovered. It is safe to say that Black Basta expanded quickly after the dismantling of the Conti ransomware group, taking advantage of the void left behind and including former Conti affiliates in its ranks in an effort to exploit the void left behind. Through this strategic expansion, the group was able to orchestrate attacks against hundreds of organizations throughout the world, establishing itself as an elite cybercriminal organization.

According to cyber-intelligence firm Prodaft, the group's campaigns have declined steadily over the past couple of months, with its last known operations occurring in December, according to the firm. Since this group was previously one of the most dominant players in the ransomware landscape, it has been the subject of considerable attention within the cybersecurity community during this abrupt downturn in activity. There are numerous sophisticated attack vectors employed by Black Basta to compromise systems, which include the following.

Among its primary tactics has been scanning for exposed RDP and VPN services around the world. This group frequently takes advantage of the default credentials available for VPN connections, or they use brute-force attacks to establish initial access by exploiting previously compromised credentials. Black Basta is also actively exploiting known Common Vulnerabilities and Exposures (CVEs) in unpatched systems, taking advantage of organizations that are not updated with security patches, or are behind in updating their security systems.

To make malware deployment much easier, ransomware operators often use MSI (Microsoft Installer) and VBS (Visual Basic Script) malware droppers that deliver malicious payloads discreetly to make malware deployments easier. The majority of these payloads are executed by misusing system utilities such as Rundll32.exe, which can be used to execute harmful DLL files as a result. Additionally, this group focuses on credential harvesting and privilege escalation, which allows them to gain a deeper understanding of a compromised network and to increase their impact.

Black Bastion’s tactics have been evolving over the years and are becoming more persistent. This is why organizations should adopt a proactive cybersecurity strategy, ensuring regular patching, robust authentication protocols, and continuous network monitoring to minimize the risks posed by this malware. There is no denying that the sophistication of malware used by threat actors greatly influences the effectiveness of ransomware operations.

As a result of developing and maintaining proprietary crypters, prominent ransomware groups like Play, Qilin, and BlackLock have distinguished themselves from the competition. It has been widely believed that leading cybercriminal organizations have used customized crypters to enhance the stealth and operational efficiency of their malware, making security systems more difficult to detect and mitigate.

A strategic advantage for these organizations is the ability to market their malware as faster and more evasive than the competitors, which will help them attract high-level affiliates. However, other ransomware groups, such as Bl00dy, Dragonforce, and RA World, rely on leaked ransomware builders that were originally developed by Babuk or LockBit. In his opinion, Jim Wilson, a ReliaQuest security analyst, believes such groups are either lacking the technical expertise required to develop proprietary malware or they are not able to afford to pay skilled developers to develop proprietary malware. From a cybersecurity perspective, the reliance on publicly available tools creates opportunities for defenders, as it enables them to analyze code and develop targeted countermeasures based on that analysis.

Recently, BlackLock has become increasingly popular within cybercriminal forums. Wilson has noted that the group actively recruits affiliates, initial access brokers, and experienced developers through the Ramp forum. The alias "$$$" is used to identify this group as active within the Ramp cybercrime forums. The BlackLock group also frequently recruits "traffers" which are cybercriminals who send victims to malicious websites before passing them off to more experienced operatives for execution. According to incident response firms, ransomware groups typically gain their first access to enterprise networks through phishing campaigns as well as by utilizing remote access tools.

Cybercriminals often use known software vulnerabilities to attack systems by infiltrating them. Sophisticated ransomware groups are constantly trying to improve their attack strategies through utilizing innovative methods. There was a post made by "$$$" on Ramp on January 28, 2025, in which he asked hackers who had experience exploiting Microsoft's Entra Connect Sync, a software that allows Active Directory to be synchronized with Entra (formerly Azure Active Directory), to be exploited.

Research published by SpecterOps in December 2024 was referenced as the basis for this request. As part of the research, attackers were able to inject their own Windows Hello for Business (WHFB) key into a victim's account to exploit Entra's synchronization mechanisms. Additionally, cybersecurity expert Garrity noted that Black Basta has demonstrated a proactive approach to vulnerability exploitation.

The group reportedly discusses new vulnerabilities within days of security advisories being released and, while hesitant, considers purchasing exploits from emerging threat actors. Furthermore, there is evidence suggesting that Black Basta possesses the necessary resources to develop new exploits. Garrity’s analysis of Black Basta’s chat logs indicates a strategic yet opportunistic approach that prioritizes well-known vulnerabilities and high-value targets.

While the group primarily leverages established exploit frameworks and widely available tools, discussions within their network suggest a potential for new exploit development and tactical evolution. For cybersecurity defenders, the key takeaway is the importance of prioritizing vulnerability remediation through an evidence-based security strategy. Cybersecurity firm Rapid7 has reported that Black Basta has continuously refined its social engineering techniques, incorporating enhanced malware payloads, improved delivery mechanisms, and advanced evasion tactics.

The group has been observed leveraging Microsoft Teams to impersonate IT personnel, often masquerading as help desk or customer support representatives. Upon engaging a victim, attackers attempt to install remote management tools such as AnyDesk, TeamViewer, or ScreenConnect, deploy malicious QR codes, or establish a reverse shell using OpenSSH. Once access is secured, malware such as Zbot or DarkGate is used to escalate privileges, harvest credentials, and bypass multifactor authentication, ultimately leading to data exfiltration and ransomware deployment.

A December 2024 attack investigated by ReliaQuest involved a Microsoft lookalike domain sending a flood of phishing emails to employees, followed by direct calls through Teams. Within minutes of gaining access via Quick Assist, the attacker established communication with a command-and-control server and began lateral movement within 48 minutes, successfully exfiltrating data from a manufacturing firm. Despite these ongoing attacks, intelligence from deep and dark web sources suggests that Black Basta’s leadership has exhibited signs of fatigue since mid-2024.

According to RedSense analyst Bohuslavskiy, key members, including a critical administrator, have reportedly lost interest in ransomware operations, possibly due to prolonged involvement since 2019 or 2020. While the group appears to be scaling down, its infrastructure remains operational, with continued victim negotiations and ransomware deployments. However, declining operational standards have led to increased failures in decryption, rendering attacks even more destructive due to the group's growing negligence.

As well, Cybersecurity expert Garrity noted that Black Basta has been proactive when it comes to exploiting vulnerabilities. It has been reported that the group discusses new vulnerabilities as soon as security advisories are released, and while it is reluctant to buy exploits from emerging threat actors, the group is still considering doing so. Several pieces of evidence suggest that Black Basta possesses the necessary resources to develop new exploits based on evidence.

According to Garrity's analysis of Black Basta's chat logs, the group takes a strategic yet opportunistic approach, prioritizing well-known vulnerabilities and high-value targets. Although the group primarily relies on established exploit frameworks and readily available tools, discussions within the group suggest that new exploits could be developed and tactically evolved in the future.

Among the key takeaways for cybersecurity defenders is the importance of prioritizing vulnerability remediation as part of an evidence-based security strategy. According to Rapid7, Black Basta has continuously reworked its social engineering techniques, including enhancing malware payloads, improving delivery mechanisms, and incorporating evasion tactics to make it more effective than before. Observations have indicated that the group uses Microsoft Teams to impersonate IT employees, often masquerading as help desk or customer support representatives.

As soon as the attacker engages a victim, he or she attempts to install remote management tools such as AnyDesk, TeamViewer, or ScreenConnect to deploy malicious QR codes, or to establish a reverse shell via OpenSSH in the event of an attack. Malware, such as Zbot, DarkGate, and other malicious programs, is then employed to escalate privileges, harvest credentials, and bypass multifactor authentication, resulting in data exfiltration and ransomware deployment. This attack is believed to have been perpetrated by a Microsoft-like domain that sent phishing emails to employees in December 2024, followed by direct calls through Teams.

After gaining access via Quick Assist in less than five minutes, the attacker established a connection with a command and control server, started moving laterally within 48 minutes, and successfully extracted information from a manufacturing company within 48 minutes. However, information from deep and dark web sources suggests that the leadership of Black Basta has shown signs of fatigue since mid-2024 despite these ongoing attacks.

It has been reported that RedSense analyst Bohuslavskiy believes key members, including a critical administrator, have lost interest in ransomware operations, possibly due to their prolonged involvement in the ransomware campaign from 2019 or 2020. Although the group appears to be reducing its operations, it has been continuing to negotiate with victims and deploy ransomware, despite its apparent scaling down. It is important to note that while operational standards are decreasing, more and more failures in decryption have arisen during the last few years, which has rendered attacks even more destructive due to the growing negligence of the group.

Urgent Patch Needed for SonicWall Firewall Exploit Enabling VPN Hijacking



 

VPN

Bishop Fox cyber threat Cyberattacks Cybersecurity firewall exploits Hijacking SonicWall VPN

Urgent Patch Needed for SonicWall Firewall Exploit Enabling VPN Hijacking

Bishop Fox cybersecurity researchers have discovered a critical security flaw in approximately 4,500 SonicWall firewalls that are exposed to the Internet as a result of a critical security breach. The flaw, CVE-2024-53704, is a high-severity authentication bypass vulnerability within SonicOS SSLVPN. Threat actors could exploit this flaw to gain unauthorized access to your VPN sessions, compromising the privacy of your sensitive data and the security of your network.

SonicWall has issued a patch to address this issue, but unpatched systems remain at immediate risk. Due to this discovery, it is imperative that organizations relying on SonicWall firewalls immediately update those firewalls to mitigate the threat of cyberattacks leveraging this exploit and mitigate the amount of damage they will incur.

In its security bulletin dated January 7, 2025, SonicWall issued a warning about the high likelihood of an exploit resulting from a recently identified authentication bypass vulnerability within its SonicOS SSLVPN application that has been released to alert customers. There was a strong recommendation the company sent out to administrators to upgrade their SonicOS firewall firmware immediately so that they could mitigate the risk of unauthorized access and potentially dangerous cyberattacks.

The SonicWall security company sent an email notification to all its customers about this critical vulnerability. In the email warning, SonicWall reiterated that the vulnerability poses an immediate threat to organizations that have SSL VPNs or SSH management enabled in their systems. This vendor stressed the importance of immediately updating firmware to protect networks and prevent malicious actors from exploiting them.

In the latest research, SonicWall's SonicOS SSLVPN application was discovered to have an authentication bypass vulnerability, which has been rated at high risk with a CVSS score of 8.2. In this particular case, the problem affects several versions of SonicOS, specifically versions 7.1.x (all versions up to 7.1.1-7058), 7.1.2-7019, and 8.0.0-8035, which are widely utilized across both Generation 6 and Generation 7 SonicWall firewalls.

Bishop Fox's cybersecurity team performed a thorough analysis of the vulnerability and successfully demonstrated exploitation scenarios to demonstrate the possibility of unauthenticated, remote attackers bypassing security mechanisms and hijacking active VPN sessions if they can bypass authentication mechanisms. To exploit this vulnerability, a specially crafted session cookie is sent to the SSL VPN endpoint's endpoint (/cgi-bin/sslvpnclient) that contains a base64-encoded string of null bytes.

The misuse of this method can allow threat actors to gain access to authenticated VPN sessions without requiring valid credentials from the users, which poses a significant risk to organizations that use SonicWall firewall products as part of their security measures. The Cyber Security Research Lab has determined that as of February 7, 2025, approximately 4,500 SonicWall SSL VPN servers that connect to the internet remain unpatched and are vulnerable to exploitation by hackers.

Initially, SonicWall published a security advisory on January 7, 2025, urging organizations to immediately update their firewall firmware to mitigate the risks associated with this high-severity vulnerability that allows authentication bypass. Several SonicOS firewall applications, which are affected by this flaw, have had firmware patches issued to address the problem. These include SonicOS 6.5.5.1-6n or later for Gen 6 firewalls, SonicOS 7.1.3-7015 or later for Gen 7 firewalls, and SonicOS 8.0.0-8037 or later for TZ80 firewalls, which have all been updated with these firmware patches.

To mitigate the risks associated with these updates, organizations unable to implement these updates are strongly recommended to temporarily disable SSL VPN access or to restrict it only to trusted IP addresses. Despite the simplicity of the exploit, the risk it poses to corporate networks is significant; this is because it opens the door for widespread abuse from threat actors seeking to gain access to corporate networks to espionage, data exfiltration, or ransomware attacks.

As soon as an adversary is inside a compromised environment, they will be able to escalate privileges, perform lateral movements, and further infiltrate critical systems. To combat these threats, administrators must immediately implement several key security measures that can help prevent these threats from happening.

Too achieve this, all affected devices need to be updated with the latest firmware, SSL VPN and SSH management access should be restricted to trusted IP ranges, firewall logs should be monitored for anomalies, such as repeat session terminations or unauthorized login attempts, and multi-factor authentication (MFA) should be implemented on all devices.

MFA, while ineffective in combating this specific exploit, remains a critical security measure that can be used against other types of cyberattacks as well. Since the risks associated with active exploitation are high, organizations should prioritize the security of their SonicWall firewalls to prevent unauthorized access to their networks, possible data breaches, and long-term network compromises.

Smiths Group Reports Cybersecurity Incident: Systems Breached



 

VPN

Cyber Security Cyberattacks CyberThreat Smiths Group unauthorised access VPN

Smiths Group Reports Cybersecurity Incident: Systems Breached

Smiths Group, a London-listed engineering firm operating in energy, security, aerospace, and defence, has reported a cybersecurity incident involving unauthorised access to its systems. The company has taken immediate steps to mitigate potential disruptions and contain the breach. In a statement issued to the London Stock Exchange, Smiths Group confirmed the detection of unauthorised activity and outlined measures to protect business continuity, including isolating affected systems and ensuring normal operations are maintained.

The company emphasized its commitment to safeguarding operations, stating that swift action was taken to minimize the impact of the breach. Smiths Group is actively restoring affected systems and assessing the impact on its business operations. However, the company has not provided specific details about the nature of the cyberattack, though indications suggest it may have been a ransomware incident, given the common practice of taking systems offline in such cases.

Impact and Response

Following the announcement of the cybersecurity breach, Smiths Group’s share price dropped by nearly 2%. The company is collaborating with cybersecurity experts to assess the extent of the breach and facilitate the restoration of affected systems. While Smiths Group has confirmed adherence to regulatory requirements, it has not disclosed details about the cause of the incident, the exact timing of its discovery, or whether business or customer data was compromised. The company has promised to provide updates “as appropriate.”

This incident is part of a growing trend of cyberattacks targeting organizations across various sectors. Earlier this month, the International Civil Aviation Organization (ICAO), a United Nations specialized agency, confirmed a data breach affecting nearly 12,000 individuals in the aviation sector. The breach exposed approximately 42,000 recruitment records from April 2016 to July 2024, with 11,929 individuals directly impacted.

Similarly, Conduent, a business services company, recently confirmed a cyberattack that caused a system outage. Meanwhile, Hewlett Packard Enterprise (HPE) is investigating claims of a data breach after an adversary allegedly accessed documents associated with its developer environment. In the UK, the domain registry Nominet reported a network compromise in early January due to a zero-day vulnerability in Ivanti VPN, which has been linked to cyber espionage activities by the UNC5337 threat group.

Why Engineering and Manufacturing Are Targeted

Smiths Group, established in 1851, employs over 15,000 people and reported annual revenues of approximately $3.89 billion in fiscal 2024. The company’s Smiths Detection arm develops security screening systems for airports and other ports of entry, while its other divisions support industries such as mining, oil, gas, clean energy, and semiconductor testing. The engineering and manufacturing sectors are prime targets for cybercriminals and nation-state hackers due to their economic importance and the sensitive nature of their work.

For example, in August, Schlatter Group, a Swiss manufacturer of industrial welding machines, fell victim to a criminal cyberattack. Smiths Group, which reported annual revenues of £3.13 billion last year, supplies products to industries including energy, safety, security, aerospace, and defence, making it a lucrative target for cyberattacks.

The cybersecurity incident at Smiths Group highlights the increasing vulnerability of engineering and manufacturing firms to cyberattacks. As cybercriminals and nation-state actors continue to target these sectors, companies must prioritize robust cybersecurity measures to protect sensitive data and maintain business continuity. Smiths Group’s swift response to the breach underscores the importance of proactive incident management, but the incident serves as a reminder of the ongoing challenges in securing critical infrastructure and industrial systems.

Malware Infections Surge from Fake VPN Downloads



 

VPN

CyberCrime Cybersecurity CyberThreat Fake VPN Google malware SEO VPN

Malware Infections Surge from Fake VPN Downloads

An attacker is reportedly injecting malware into infected devices using popular VPN applications to gain remote control of the devices they are attacking. Google's Managed Defense team reported this disturbing finding, which sheds light on how malicious actors use SEO poisoning tactics to spread what is known as Playfulghost.

It has become increasingly important for individuals who prioritize the protection of their personal data and online privacy to use virtual private networks (VPNs). VPNs establish a secure, encrypted connection between users' devices and the internet, protecting their IP addresses and online activity against prying eyes.

However, it should be noted that not all VPN applications are trustworthy. The number of fake VPN apps being distributed under the guise of legitimate services is increasing, stealing the sensitive information of unsuspecting users. Researchers have discovered that during the third quarter of 2024, fake VPN applications have become increasingly widespread globally, which is a worrying trend. In comparison to the second quarter, security analysts have reported a 2.5-fold increase in user encounters with fraudulent VPN apps.

These apps were either infected with malware or were built in such a way that they could be exploited by malicious actors. As a result of this alarming development, it is critical to be vigilant when choosing VPN services. Users should take precautionary measures when choosing VPN services and ensure that the apps they download are legitimate before downloading to safeguard their data and devices.

As more and more home users turn to virtual private networks (VPNs) as a means to safeguard their privacy, to ensure their internet activity is secure, and to circumvent regional content blocks, these VPNs are becoming increasingly popular. Scammers and hackers are aware that the popularity of VPNs is growing, and so they intend to take advantage of that trend as much as possible.

As an example, recently it has been found that some VPNs have been found to have security vulnerabilities that do not make them as secure as they should be. Playfulghost is a backdoor similar to Gh0st RAT, a remote administration tool that is well-known in the security community. According to Google's expert, Playfulghost is "a backdoor that shares functionality with Gh0st RAT." The latter has been around since 2008, and it is considered one of the best.

The traffic patterns of Playfulghost can be distinguished from those of other known threats, especially in terms of encryption and traffic patterns. There are several ways hackers use phishing and SEO poisoning to trick their victims into downloading malicious software onto their computers, and according to a Google expert, one victim was tricked into opening a malicious image file for Playfulghost to run remotely from a remote location, which results in the malware being downloaded onto his computer. In the same vein, SEO poisoning techniques employed trojanized virtual private network (VPN) apps to download Playfulghost components from a remote server on the victims' devices (see GIF below).

Infected with Payfulghost, an attacker can remotely execute a wide range of tasks on the device once it has been infected. It is particularly dangerous as a virus. Data mining is capable of capturing keystrokes, screenshots, and audio, as well as capturing screenshots. In addition to this, attackers can also perform file management activities, including opening, deleting, and writing new files. Security experts from Google have warned that a new malware threat has been detected that is very dangerous. It is known as Playfulghost and is distributed worldwide via fraudulent VPN apps. Researchers have warned that this scam uses sophisticated techniques to trick users into downloading infected VPN software, including what is called "SEO poisoning".

There is something especially cruel about this latest cyberattack because signing up for one of the best VPN deals is usually an easy way to improve users' level of privacy and security online. Unfortunately, those who installed the fake VPN applications laced with malware in the last few days have now found themselves in the worst possible position due to the malware they have installed. As people know, the purpose of Playfulghost is to allow hackers to monitor every letter users type on their keyboard, a practice known as keylogging.

It can also record audio from the built-in microphone on users' computers, laptops, tablets, or desktops, and it can also be used as a tool to record what they are seeing on the screen, which is often used for blackmail. The dangerous malware also enables attackers to remotely execute various file management activities, including opening, deleting, and writing new files, This can enable hackers to download and install other types of malware on machines infected with Playfulghost. Playfulghost also makes it possible for attackers to perform various file management activities remotely, such as opening, deleting, and creating files, allowing hackers to download and install other kinds of malware on computers infected with this dangerous malware.

As it turns out, Playfulghost's functionality is quite similar to Gh0st RAT, which has wreaked havoc on PCs since 2001 and is now a public open-source tool, whose source code was released in 2008. Since this code is widely available, there have been several copies and clones created, including the latest variant. In addition to utilizing distinct traffic patterns and encryption, Google security researchers have pinpointed two methods by which the malware is being spread by hackers, according to their study. The first is using the infected computers' network cables and the second is via the Internet.

The first thing to know is that cybercriminals are utilizing phishing emails — unsolicited messages that entice people to download malicious software. One of the earliest examples that was spotted by Google's team involved emails with themes such as "Code of Conduct" which trick users into downloading the attached file, which turned out to be Playfulghost, a nasty infection.

Another documented case has also been found in which a victim was tricked into opening a malicious image file and when they opened it in the background Playfulghost was automatically installed and activated on their computer from a remote server. Secondly, the malware may also be spread by bundling it with popular VPN apps in a process known as SEO poisoning. This method has been gaining popularity recently among virus creators. Search engine poisoning is the act of manipulating or hacking a search engine to make malicious downloads appear as an official import.

Critical Flaws in VPN Protocols Leave Millions Vulnerable



 

WireGuard

IPsec Security VPN Vulnerabilities and Exploits WireGuard

Critical Flaws in VPN Protocols Leave Millions Vulnerable

Virtual Private Networks (VPNs) are widely trusted for protecting online privacy, bypassing regional restrictions, and securing sensitive data. However, new research has uncovered serious flaws in some VPN protocols, exposing millions of systems to potential cyberattacks.

A study by Top10VPN, conducted in collaboration with cybersecurity expert Mathy Vanhoef, highlights these alarming issues. The research, set to be presented at the USENIX 2025 Conference, reveals vulnerabilities in VPN tunnelling protocols affecting over 4 million systems worldwide. Impacted systems include:

VPN servers
Home routers
Mobile networks
Corporate systems used by companies such as Meta and Tencent

The Problem with VPN Tunneling Protocols

Tunneling protocols are essential mechanisms that encrypt and protect data as it travels between a user and a VPN server. However, the study identified critical weaknesses in specific protocols, including:

IP6IP6
GRE6
4in6
6in4

These vulnerabilities allow attackers to bypass security measures by sending manipulated data packets through the affected protocols, enabling unauthorized access and a range of malicious activities, such as:

Denial-of-Service (DoS) attacks disrupting systems
Stealing sensitive information by breaching private networks
Undetected repeated infiltrations

Advanced encryption tools like IPsec and WireGuard play a crucial role in safeguarding data. These technologies provide strong end-to-end encryption, ensuring data is decoded only by the intended server. This added security layer prevents hackers from exploiting weak points in VPN systems.

The vulnerabilities are not confined to specific regions. They predominantly affect servers and services in the following countries:

United States
Brazil
China
France
Japan

Both individual users and large organizations are impacted, emphasizing the need for vigilance and regular updates.

How to Stay Protected

To enhance VPN security, consider these steps:

Choose a VPN with strong encryption protocols: Look for services that utilize tools like IPsec or WireGuard.
Regularly update your VPN software: Updates often include patches for fixing vulnerabilities.
Research your VPN provider: Opt for reputable services with a proven track record in cybersecurity.

This research serves as a critical reminder: while VPNs are designed to protect privacy, they are not immune to flaws. Users must remain proactive, prioritize robust security features, and stay informed about emerging vulnerabilities.

By taking these precautions, both individuals and organizations can significantly reduce the risks associated with these newly discovered VPN flaws. Remember, no tool is entirely foolproof — staying informed is the key to online safety.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Showing result(s) for