Starlight Intelligence on LinkedIn: Unpatched AVTECH IP Camera Flaw Exploited by Hackers for Botnet Attacks (2024)

30 Aug 2024 : Most Active Threat Indicators#Cybersecurity #Cyberattack #RCE #Botnet #IOCTop 3 Source Countries:- Egypt (EG): The most prominent source of attacks, primarily utilizing the Mirai botnet and exploiting various vulnerabilities, including MVPower DVR shell vulnerabilities.- China (CN): Involved in multiple attacks, particularly targeting vulnerabilities in D-Link and NETGEAR devices, as well as Apache HTTP Server exploits.- India (IN): Active in attacks exploiting multiple routers and utilizing the Mozi botnet, along with various command injection vulnerabilities.Source IP20[.]174[.]160[.]19745[.]230[.]66[.]15745[.]230[.]66[.]14345[.]230[.]66[.]14845[.]230[.]66[.]3145[.]87[.]9[.]239160[.]154[.]248[.]161115[.]63[.]56[.]66222[.]134[.]162[.]65219[.]128[.]20[.]72182[.]127[.]162[.]90122[.]97[.]136[.]1961[.]142[.]85[.]157120[.]86[.]255[.]211120[.]85[.]182[.]14327[.]215[.]83[.]7461[.]141[.]253[.]44120[.]86[.]236[.]216120[.]229[.]207[.]72120[.]86[.]253[.]180182[.]121[.]78[.]24213[.]199[.]53[.]204207[.]154[.]218[.]12841[.]98[.]75[.]76156[.]223[.]216[.]110156[.]193[.]206[.]15641[.]36[.]165[.]115156[.]211[.]142[.]841[.]46[.]241[.]12841[.]238[.]95[.]24156[.]220[.]231[.]941[.]234[.]37[.]41197[.]55[.]145[.]51197[.]48[.]32[.]4941[.]43[.]78[.]210197[.]46[.]243[.]205197[.]37[.]79[.]3241[.]47[.]39[.]41156[.]222[.]220[.]7641[.]35[.]44[.]7541[.]36[.]99[.]21141[.]42[.]254[.]46156[.]215[.]31[.]22241[.]46[.]185[.]187197[.]37[.]199[.]16741[.]34[.]6[.]57156[.]195[.]9[.]162156[.]214[.]78[.]249197[.]40[.]13[.]57197[.]33[.]201[.]65156[.]222[.]81[.]76156[.]219[.]91[.]8741[.]238[.]29[.]22341[.]35[.]34[.]24156[.]214[.]39[.]12141[.]46[.]162[.]113156[.]222[.]113[.]85156[.]215[.]75[.]154197[.]40[.]11[.]18541[.]35[.]104[.]9941[.]44[.]70[.]18741[.]239[.]189[.]59156[.]196[.]100[.]17241[.]40[.]153[.]66156[.]204[.]4[.]2478[.]211[.]199[.]102103[.]72[.]147[.]115199[.]45[.]154[.]1308[.]215[.]3[.]241202[.]43[.]178[.]229165[.]22[.]211[.]250117[.]208[.]250[.]148117[.]255[.]96[.]25117[.]216[.]16[.]169117[.]248[.]166[.]4559[.]183[.]133[.]180117[.]248[.]166[.]232117[.]203[.]56[.]48117[.]210[.]181[.]47117[.]196[.]111[.]35117[.]254[.]102[.]17959[.]85[.]166[.]118154[.]216[.]16[.]80116[.]71[.]173[.]21582[.]167[.]122[.]207172[.]232[.]159[.]1347[.]236[.]50[.]27167[.]172[.]64[.]10954[.]186[.]44[.]25318[.]117[.]197[.]4518[.]188[.]40[.]2934[.]145[.]238[.]133[.]142[.]46[.]2423[.]142[.]239[.]1173[.]23[.]20[.]96167[.]94[.]146[.]6118[.]188[.]16[.]4514[.]225[.]206[.]9445[.]118[.]144[.]54185[.]240[.]64[.]180

Cyberattackers Exploit Google Sheets for Phishing CampaignsCyberattackers are leveraging Google Sheets as a tool for sophisticated phishing campaigns, tricking users into revealing sensitive information. By embedding malicious links and scripts within shared Google Sheets documents, attackers can bypass traditional security measures and target unsuspecting users. This method allows them to harvest credentials and personal data effectively, posing a significant risk to individuals and organizations alike.The importance of this issue lies in the widespread use of Google Sheets and similar cloud-based tools for collaboration and data sharing. As more users rely on these platforms for work and personal tasks, the potential for falling victim to such phishing schemes increases. This trend highlights the need for enhanced awareness and security practices surrounding the use of cloud applications.To prevent falling prey to these phishing attacks, users should be cautious when interacting with shared documents, especially from unknown sources. Implementing multi-factor authentication (MFA) can provide an additional layer of security against unauthorized access. Organizations should also conduct regular training sessions to educate employees about recognizing phishing attempts and employing best practices for secure document sharing.#Cybersecurity https://lnkd.in/g2_RdJgt

Fake Palo Alto GlobalProtect Used as Lure to Backdoor EnterprisesA recent security report reveals that attackers are using a fake version of Palo Alto Networks' GlobalProtect VPN client as a lure to backdoor enterprise networks. This malicious software mimics the legitimate GlobalProtect application, tricking users into installing it. Once installed, the fake client allows attackers to gain unauthorized access to sensitive data and systems, posing a significant threat to organizational security.This issue is critical as it highlights the increasing sophistication of cyber threats targeting remote work environments. With the rise of remote work, organizations are increasingly reliant on VPNs for secure access to corporate networks. The exploitation of trusted applications like GlobalProtect underscores the need for heightened vigilance and robust security measures to protect against such deceptive tactics.To prevent falling victim to these types of attacks, organizations should implement strict software verification processes, ensuring that all applications are downloaded from official sources. Regular employee training on recognizing phishing attempts and suspicious software is essential. Additionally, employing advanced threat detection solutions can help identify and mitigate potential threats before they compromise network security.#Cybersecurityhttps://lnkd.in/dDDvjJrc

29 Aug 2024 : Most Active Threat Indicators#Cybersecurity #Cyberattack #RCE #Botnet #IOCTop 3 Source Countries:- China (CN): Responsible for multiple attacks exploiting vulnerabilities in NETGEAR and D-Link devices, as well as the Mozi botnet.- India (IN): Involved in attacks targeting NETGEAR devices, the Mozi botnet, and GPON routers, as well as a DDWRT HTTP Daemon vulnerability.- Mexico (MX): Observed in attacks related to the Mozi botnet.Source IP45[.]230[.]66[.]1313[.]26[.]100[.]545[.]176[.]31[.]253138[.]197[.]166[.]4314[.]29[.]200[.]186183[.]212[.]235[.]33119[.]116[.]103[.]1125[.]125[.]217[.]133120[.]86[.]253[.]202112[.]248[.]191[.]125115[.]215[.]141[.]252120[.]85[.]185[.]104120[.]85[.]91[.]24115[.]63[.]40[.]2445[.]88[.]109[.]148154[.]47[.]27[.]76131[.]159[.]24[.]205161[.]35[.]211[.]102167[.]172[.]181[.]55164[.]92[.]244[.]19477[.]237[.]243[.]66196[.]188[.]80[.]24083[.]229[.]84[.]4487[.]236[.]176[.]7445[.]128[.]145[.]22139[.]109[.]126[.]25482[.]153[.]226[.]200103[.]197[.]115[.]19459[.]91[.]81[.]87117[.]248[.]160[.]171117[.]248[.]172[.]227128[.]199[.]28[.]114117[.]219[.]128[.]4159[.]182[.]156[.]103117[.]255[.]182[.]4659[.]92[.]175[.]239128[.]199[.]20[.]229103[.]197[.]115[.]163117[.]252[.]173[.]85117[.]253[.]104[.]1117[.]248[.]163[.]20461[.]3[.]109[.]8259[.]85[.]166[.]118103[.]230[.]14[.]30125[.]138[.]3[.]23441[.]249[.]155[.]4685[.]239[.]33[.]187177[.]245[.]152[.]159177[.]245[.]155[.]121177[.]245[.]152[.]78177[.]245[.]153[.]206177[.]245[.]155[.]181177[.]245[.]154[.]190177[.]245[.]154[.]31177[.]245[.]153[.]0177[.]245[.]152[.]106177[.]245[.]155[.]93177[.]245[.]155[.]136177[.]245[.]152[.]217177[.]245[.]155[.]122177[.]245[.]152[.]165177[.]245[.]153[.]141177[.]245[.]153[.]212177[.]245[.]154[.]161177[.]245[.]155[.]14177[.]245[.]154[.]225177[.]245[.]153[.]66177[.]245[.]155[.]230177[.]245[.]155[.]182177[.]245[.]152[.]183177[.]245[.]155[.]79177[.]245[.]153[.]77177[.]245[.]152[.]134177[.]245[.]154[.]55177[.]245[.]152[.]12637[.]60[.]250[.]63185[.]224[.]128[.]47195[.]62[.]32[.]133175[.]107[.]3[.]157175[.]107[.]2[.]176193[.]32[.]162[.]9679[.]170[.]24[.]209176[.]225[.]237[.]185165[.]22[.]53[.]132178[.]128[.]97[.]138128[.]199[.]160[.]3741[.]79[.]199[.]20125[.]26[.]173[.]238146[.]190[.]119[.]1893[.]128[.]33[.]247137[.]184[.]226[.]25018[.]221[.]219[.]19118[.]117[.]95[.]1318[.]190[.]26[.]4818[.]224[.]110[.]17964[.]31[.]3[.]105209[.]38[.]30[.]171198[.]105[.]124[.]18918[.]188[.]123[.]13[.]142[.]218[.]208

Russian APT29 Hackers Use iOS Chrome Exploits Created by Spyware VendorsThe Russian APT29 hacking group, also known as Cozy Bear, has been leveraging exploits in the iOS version of the Chrome browser, which were developed by commercial spyware vendors. These exploits can allow attackers to gain unauthorized access to sensitive information and systems, posing a significant threat to individuals and organizations that rely on mobile devices for communication and data management.This issue is particularly important as it highlights the growing trend of state-sponsored cyber espionage, where sophisticated hacking groups utilize advanced tools and techniques to compromise targets. The use of exploits created by spyware vendors indicates a troubling collaboration between malicious actors and commercial entities, raising concerns about the security of widely used applications and the potential for widespread data breaches.To mitigate the risks associated with these exploits, users are advised to keep their devices updated with the latest security patches and to be cautious of suspicious links and downloads. Organizations should also implement robust security measures, including mobile device management and employee training on recognizing phishing attempts, to enhance their defenses against such advanced threats.#Cybersecurityhttps://lnkd.in/eNWca7jh

28 Aug 2024 : Most Active Threat Indicators#Cybersecurity #Cyberattack #RCE #Botnet #IOCTop 3 Source Countries:- United States (US): Responsible for multiple attacks using various scanners like Censys, ZGrab, and Nmap, as well as SQL injection and botnet activity.- China (CN): Involved in attacks exploiting vulnerabilities in D-Link devices, Apache HTTP Server, and the Mozi botnet.- India (IN): Observed in attacks targeting vulnerabilities in GPON routers, NETGEAR devices, and D-Link devices, as well as Mozi botnet activity.Source IP3[.]26[.]100[.]213[.]27[.]169[.]2057[.]151[.]48[.]46189[.]99[.]6[.]9827[.]43[.]204[.]122115[.]55[.]236[.]4442[.]179[.]48[.]10116[.]138[.]13[.]154115[.]55[.]78[.]50112[.]248[.]100[.]157112[.]94[.]96[.]4761[.]53[.]103[.]50123[.]14[.]209[.]227124[.]223[.]29[.]38121[.]206[.]162[.]199120[.]86[.]252[.]60222[.]140[.]196[.]101149[.]50[.]215[.]66185[.]230[.]138[.]12277[.]237[.]243[.]196196[.]188[.]115[.]241217[.]138[.]196[.]10387[.]236[.]176[.]51103[.]225[.]84[.]12145[.]128[.]145[.]22820[.]189[.]123[.]215199[.]45[.]154[.]141103[.]197[.]115[.]19559[.]88[.]10[.]104117[.]247[.]148[.]3661[.]3[.]131[.]250103[.]199[.]180[.]3459[.]95[.]130[.]144117[.]243[.]177[.]12059[.]89[.]198[.]253117[.]242[.]248[.]172117[.]212[.]61[.]100117[.]254[.]3[.]118117[.]253[.]98[.]1859[.]183[.]103[.]14759[.]93[.]224[.]177117[.]202[.]67[.]18659[.]184[.]56[.]21127[.]122[.]61[.]220103[.]199[.]200[.]5559[.]183[.]109[.]186117[.]235[.]106[.]151139[.]59[.]7[.]72193[.]151[.]141[.]20682[.]221[.]111[.]235[.]188[.]66[.]13154[.]216[.]16[.]8095[.]214[.]27[.]9206[.]189[.]109[.]80195[.]62[.]32[.]13345[.]148[.]10[.]145185[.]243[.]218[.]202188[.]113[.]170[.]24977[.]239[.]218[.]14581[.]30[.]176[.]5546[.]246[.]122[.]5235[.]240[.]142[.]201152[.]42[.]193[.]1441[.]10[.]212[.]36122[.]155[.]0[.]70206[.]168[.]34[.]46162[.]142[.]125[.]38206[.]168[.]34[.]113206[.]168[.]34[.]32172[.]168[.]47[.]713[.]16[.]30[.]15157[.]152[.]56[.]114167[.]172[.]224[.]13818[.]116[.]31[.]23645[.]8[.]22[.]20754[.]218[.]16[.]2543[.]140[.]207[.]125162[.]142[.]125[.]3364[.]226[.]65[.]16020[.]118[.]68[.]133209[.]38[.]17[.]22420[.]118[.]71[.]186172[.]206[.]141[.]12413[.]58[.]16[.]23840[.]83[.]135[.]153167[.]94[.]146[.]50172[.]206[.]139[.]153[.]142[.]240[.]83167[.]94[.]145[.]98206[.]168[.]34[.]50162[.]142[.]125[.]193144[.]202[.]7[.]25172[.]168[.]41[.]854[.]151[.]38[.]208172[.]206[.]140[.]227146[.]190[.]165[.]254170[.]64[.]238[.]14413[.]58[.]15[.]76171[.]250[.]11[.]165103[.]114[.]106[.]2

APT-C-60 Group Exploits WPS Office FlawThe APT-C-60 cyber espionage group has been exploiting a critical vulnerability in WPS Office, a popular office suite, to conduct targeted attacks. This flaw allows attackers to execute arbitrary code on affected systems, which can lead to data breaches and unauthorized access to sensitive information. The exploitation of this vulnerability highlights the ongoing threat posed by advanced persistent threat (APT) groups in the cybersecurity landscape.Addressing this issue is crucial as APT-C-60's activities underscore the risks associated with using widely adopted software like WPS Office. Given the increasing frequency of sophisticated cyberattacks, organizations must be vigilant in securing their systems against such vulnerabilities, as they can lead to significant financial and reputational damage.To prevent exploitation of this vulnerability, users are urged to update their WPS Office software to the latest version immediately. Additionally, implementing robust security practices, such as regular software updates, employee training on recognizing phishing attempts, and utilizing endpoint protection solutions, can help mitigate the risks associated with APT attacks.#Cybersecurity https://lnkd.in/gd7yE3bc

New QR Code Phishing Campaign Exploits Popular AppsA recent phishing campaign has been discovered that utilizes QR codes to trick users into providing sensitive information. Attackers are embedding malicious QR codes in popular applications, leading unsuspecting users to fraudulent websites designed to harvest personal data. This method of phishing is particularly concerning as it exploits the convenience of QR codes, making it easier for attackers to bypass traditional security measures.The importance of addressing this issue lies in the growing reliance on QR codes for various transactions and services, especially in a post-pandemic world where contactless interactions have surged. As more users engage with QR codes, the potential for falling victim to such phishing schemes increases, posing significant risks to personal and organizational security.To prevent falling victim to these attacks, users are advised to verify the source of QR codes before scanning them and to be cautious of any requests for sensitive information. Organizations should also educate their employees about the risks associated with QR codes and implement security measures such as URL filtering and multi-factor authentication to enhance protection against phishing attempts.#Cybersecurityhttps://lnkd.in/dv5AJysQ

BlackByte Ransomware Exploits VMware VulnerabilityThe BlackByte ransomware group has been exploiting a critical vulnerability in VMware's products, specifically targeting the vCenter Server and ESXi hypervisors. This vulnerability, if left unpatched, allows attackers to execute arbitrary code, potentially leading to severe data breaches and system compromises. The active exploitation of this flaw poses a significant risk to organizations relying on VMware for their virtualization needs.Addressing this issue is crucial as ransomware attacks have become increasingly sophisticated and prevalent, threatening the integrity and availability of critical data. The exploitation of VMware vulnerabilities not only endangers individual organizations but also poses a broader risk to the cybersecurity landscape, as successful attacks can lead to widespread disruptions and financial losses.To prevent such attacks, organizations are urged to apply the latest security patches released by VMware immediately. Additionally, implementing strong security measures, such as regular system audits, network segmentation, and employee training on phishing and social engineering tactics, can help mitigate the risk of ransomware infections.#Cybersecurityhttps://lnkd.in/ghnmviT5