CySecurity News - Latest Information Security and Hacking Incidents: IP Address

Credential Theft Data Breach Data Theft Emails IP Address Microsoft Microsoft SharePoint phishing

Attackers Hijack Microsoft Email Accounts to Launch Phishing Campaign Against Energy Firms

Cybercriminals have compromised Microsoft email accounts belonging to organizations in the energy sector and used those trusted inboxes to distribute large volumes of phishing emails. In at least one confirmed incident, more than 600 malicious messages were sent from a single hijacked account.

Microsoft security researchers explained that the attackers did not rely on technical exploits or system vulnerabilities. Instead, they gained access by using legitimate login credentials that were likely stolen earlier through unknown means. This allowed them to sign in as real users, making the activity harder to detect.

The attack began with emails that appeared routine and business-related. These messages included Microsoft SharePoint links and subject lines suggesting formal documents, such as proposals or confidentiality agreements. To view the files, recipients were asked to authenticate their accounts.

When users clicked the SharePoint link, they were redirected to a fraudulent website designed to look legitimate. The site prompted them to enter their Microsoft login details. By doing so, victims unknowingly handed over valid usernames and passwords to the attackers.

After collecting credentials, the attackers accessed the compromised email accounts from different IP addresses. They then created inbox rules that automatically deleted incoming emails and marked messages as read. This step helped conceal the intrusion and prevented account owners from noticing unusual activity.

Using these compromised inboxes, the attackers launched a second wave of phishing emails. These messages were sent not only to external contacts but also to colleagues and internal distribution lists. Recipients were selected based on recent email conversations found in the victim’s inbox, increasing the likelihood that the messages would appear trustworthy.

In this campaign, the attackers actively monitored inbox responses. They removed automated replies such as out-of-office messages and undeliverable notices. They also read replies from recipients and responded to questions about the legitimacy of the emails. All such exchanges were later deleted to erase evidence.

Any employee within an energy organization who interacted with the malicious links was also targeted for credential theft, allowing the attackers to expand their access further.

Microsoft confirmed that the activity began in January and described it as a short-duration, multi-stage phishing operation that was quickly disrupted. The company did not disclose how many organizations were affected, identify the attackers, or confirm whether the campaign is still active.

Security experts warn that simply resetting passwords may not be enough in these attacks. Because attackers can interfere with multi-factor authentication settings, they may maintain access even after credentials are changed. For example, attackers can register their own device to receive one-time authentication codes.

Despite these risks, multi-factor authentication remains a critical defense against account compromise. Microsoft also recommends using conditional access controls that assess login attempts based on factors such as location, device health, and user role. Suspicious sign-ins can then be blocked automatically.

Additional protection can be achieved by deploying anti-phishing solutions that scan emails and websites for malicious activity. These measures, combined with user awareness, are essential as attackers increasingly rely on stolen identities rather than software flaws.

Researchers Disrupt Major Botnet Network After It Infects Millions of Android Devices



 

malware

Aisuru Android Botnets IP Address malware

Researchers Disrupt Major Botnet Network After It Infects Millions of Android Devices

Security researchers have dismantled a substantial portion of the infrastructure powering the Kimwolf and Aisuru botnets, cutting off communication to more than 550 command-and-control servers used to manage infected devices. The action was carried out by Black Lotus Labs, the threat intelligence division of Lumen Technologies, and began in early October 2025.

Kimwolf and Aisuru operate as large-scale botnets, networks of compromised devices that can be remotely controlled by attackers. These botnets have been used to launch distributed denial-of-service attacks and to route internet traffic through infected devices, effectively turning them into unauthorized residential proxy nodes.

Kimwolf primarily targets Android systems, with a heavy concentration on unsanctioned Android TV boxes and streaming devices. Prior technical analysis showed that the malware is delivered through a component known as ByteConnect, which may be installed directly or bundled into applications that come preloaded on certain devices. Once active, the malware establishes persistent access to the device.

Researchers estimate that more than two million Android devices have been compromised. A key factor enabling this spread is the exposure of Android Debug Bridge services to the internet. When left unsecured, this interface allows attackers to install malware remotely without user interaction, enabling rapid and large-scale infection.

Follow-up investigations revealed that operators associated with Kimwolf attempted to monetize the botnet by selling access to the infected devices’ internet connections. Proxy bandwidth linked to compromised systems was offered for sale, allowing buyers to route traffic through residential IP addresses in exchange for payment.

Black Lotus Labs traced parts of the Aisuru backend to residential SSH connections originating from Canadian IP addresses. These connections were used to access additional servers through proxy infrastructure, masking malicious activity behind ordinary household networks. One domain tied to this activity briefly appeared among Cloudflare’s most accessed domains before being removed due to abuse concerns.

In early October, researchers identified another Kimwolf command domain hosted on infrastructure linked to a U.S.-based hosting provider. Shortly after, independent reporting connected multiple proxy services to a now-defunct Discord server used to advertise residential proxy access. Individuals associated with the hosting operation were reportedly active on the server for an extended period.

During the same period, researchers observed a sharp increase in Kimwolf infections. Within days, hundreds of thousands of new devices were added to the botnet, with many of them immediately listed for sale through a single residential proxy service.

Further analysis showed that Kimwolf infrastructure actively scanned proxy services for vulnerable internal devices. By exploiting configuration flaws in these networks, the malware was able to move laterally, infect additional systems, and convert them into proxy nodes that were then resold.

Separate research uncovered a related proxy network built from hundreds of compromised home routers operating across Russian internet service providers. Identical configurations and access patterns indicated automated exploitation at scale. Because these devices appear as legitimate residential endpoints, malicious traffic routed through them is difficult to distinguish from normal consumer activity.

Researchers warn that the abuse of everyday consumer devices continues to provide attackers with resilient, low-visibility infrastructure that complicates detection and response efforts across the internet.

Proxy Servers: How They Work and What They Actually Do



 

VPN

https Internet of Things IP Address Privacy Proxy Server VPN

Proxy Servers: How They Work and What They Actually Do

When browsing online, your device usually connects directly to a website’s server. However, in certain cases, especially for privacy, security, or access control — a proxy server acts as a go-between. It stands between your device and the internet, forwarding your web requests and returning responses while showing its own public IP address instead of yours.

According to the U.S. National Institute of Standards and Technology (NIST), a proxy server is essentially a system that handles requests from clients and forwards them to other servers. In simple terms, it’s a digital middleman that manages the communication between you and the websites you visit.

How a Proxy Server Operates

Here’s how the process works:

1. Your computer or device sends a request to the proxy server instead of directly contacting a website.

2. The proxy then forwards that request to the destination site.

3. The site responds to the proxy.

4. The proxy returns the data to your device.

From your perspective, it looks like a normal browsing session, but from the website’s end, the request appears to come from the proxy’s IP address. Proxies can exist as physical network devices or as cloud-based services that users configure through system or browser settings.

Companies often use “reverse proxies” to manage and filter incoming traffic to their web servers. These reverse proxies can block malicious activity, balance heavy traffic loads, and improve performance by caching frequently accessed pages.

Why People Use Proxy Servers

Proxy servers are used for several reasons. They provide a basic layer of privacy by hiding your actual IP address and limiting what websites can track about you. They can also make it appear that you’re browsing from another location, allowing access to region-locked content or websites blocked in your area.

In workplaces and educational institutions, proxies help administrators restrict certain sites, monitor browsing activity, and reduce bandwidth consumption by storing copies of commonly visited web pages. Large organizations also rely on proxies to safeguard internal systems and regulate how employees connect to external networks.

The Limitations and Risks

Despite their advantages, proxy servers have notable limits. They do not encrypt your internet traffic, which means that if your connection is not secured through HTTPS, the information passing through can still be intercepted. Free or public proxy services pose particular risks, they often slow down browsing, log user activity, inject advertisements, or even harvest data for profit.

For users seeking genuine privacy or security, experts recommend using paid, reputable proxy services or opting for a Virtual Private Network (VPN). VPNs extend the idea of a proxy by adding encryption, ensuring that all traffic between the user and the internet is protected.

Proxy vs. VPN vs. NAT

Although proxies, VPNs, and Network Address Translation (NAT) all sit between your device and the wider web, they function differently.

• Proxy: Masks your IP address and filters traffic but does not encrypt your connection.

• VPN: Encrypts all online activity and provides a stronger layer of privacy and security.

• NAT: Operates within routers, allowing multiple devices in a household or office to share one public IP address. It’s a background process, not a privacy tool.

Proxy servers are practical tools for managing internet access, optimizing traffic, and adding basic privacy. However, they should not be mistaken for comprehensive security solutions. Users should view proxies as one layer of digital protection, effective when used properly, but insufficient on their own. For strong privacy, encryption, and security, a VPN remains the more reliable choice.

Using a VPN Is Essential for Online Privacy and Data Protection



 

Password Privacy

Cyber Defenses cyberattack protection Data protection data security IP Address ISP NordVPN Online Privacy Password Privacy

Using a VPN Is Essential for Online Privacy and Data Protection

Virtual Private Networks, or VPNs, have evolved from tools used to bypass geographic content restrictions into one of the most effective defenses for protecting digital privacy and data security. By encrypting your internet traffic and concealing your real IP address, VPNs make it far more difficult for anyone — from hackers to internet service providers (ISPs) — to monitor or intercept your online activity.

When connected to a VPN, your data is sent through a secure, encrypted tunnel before reaching its destination. This means that any information transmitted between your device and the VPN server remains unreadable to outsiders. Once your data reaches the server, it’s decrypted and forwarded to the intended website or application. In return, the response is re-encrypted before traveling back to you. Essentially, your data is “cloaked” from potential attackers, making it especially valuable when using public Wi-Fi networks, where Man-in-the-Middle (MITM) attacks such as IP spoofing or Wi-Fi eavesdropping are common.

For businesses, combining VPN usage with endpoint security and antivirus software strengthens overall cybersecurity posture by reducing exposure to network vulnerabilities.

A key advantage of VPNs lies in hiding your IP address, which can otherwise reveal your geographic location and online behavior. Exposing your IP makes you vulnerable to phishing, hacking, and DDoS attacks, and it can even allow malicious actors to impersonate you online. By rerouting your connection through a VPN server, your actual IP is replaced by the server’s, ensuring that websites and external entities can’t trace your real identity or location.

In addition to safeguarding data, VPNs also help counter ISP throttling — the practice of deliberately slowing internet connections during high-traffic periods or after reaching data caps. With a VPN, your ISP cannot see the exact nature of your online activities, whether streaming, gaming, or torrenting. While ISPs can still detect VPN usage and measure total data transferred, they lose visibility into your specific browsing habits.

Without a VPN, ISPs can track every website you visit, your search history, and even personal information transmitted over unencrypted connections. This data can be sold to advertisers or used to create detailed user profiles. Even browsing in Incognito mode doesn’t prevent ISPs from seeing your activity — it merely stops your device from saving it locally.

Beyond using a VPN, good cyber hygiene is crucial. Keep your software and devices updated, use strong passwords, and enable antivirus protection. Avoid sharing unnecessary personal data online and think twice before storing sensitive information on unsecured platforms.

Ultimately, a VPN isn’t a luxury — it’s a fundamental privacy tool. It protects your data, masks your identity, and keeps your online behavior hidden from prying eyes. In an era of widespread tracking and data monetization, using a VPN is one of the simplest and most effective ways to reclaim your digital privacy.

Telegram’s Alleged Ties to Russian Intelligence Raise Global Surveillance Fears



 

Russia links

Cloud Cyber Security Data Safety User Data data security FSB IP Address Messaging Apps Russia Russia links

Telegram’s Alleged Ties to Russian Intelligence Raise Global Surveillance Fears

A new investigation by Russian media outlet Important Stories, in collaboration with the Organized Crime and Corruption Reporting Project (OCCRP), has sparked fresh scrutiny over Telegram’s connections to Russia’s intelligence services. The popular messaging platform, long regarded for its privacy features, may have indirect links to the Russian Federal Security Service (FSB), raising significant concerns for users worldwide.

At the center of the probe is a company called Global Network Management (GNM), which plays a critical role in routing Telegram’s messages. Although GNM is officially incorporated in the Caribbean nation of Antigua and Barbuda, it operates primarily from Russia. Its owner, Vladimir Vedeneev, is a Russian engineer with long-standing ties to Telegram founder Pavel Durov. Legal filings show that Vedeneev is the only individual authorized to manage certain Telegram servers, including those based in the U.S.

Vedeneev also runs other firms—such as Globalnet and Electrontelecom—that reportedly supply telecommunications infrastructure to various Russian state entities, including the FSB. These companies have been linked to classified government projects involving surveillance and defense.

The IP addresses used by Telegram used to be owned by Russian firms with FSB affiliations. These IPs still appear to be registered in Russia, and might be responsible for allowing user activity to be traced back through Russian-controlled networks. Telegram users typically rely on regular cloud chats, which—unlike its secret chats—are not end-to-end encrypted and are stored on Telegram’s servers. Security analysts warn that if Vedeneev’s companies manage routing systems and network infrastructure, they could potentially access user metadata, including IP addresses, device IDs, and location data.

Though message content may remain encrypted, this metadata could still be exploited for surveillance. Moreover, Telegram transmits unique device identifiers in an unencrypted format, creating additional vulnerability. Experts caution that Russian intelligence could leverage this data to monitor users, particularly dissidents, journalists, or foreign nationals viewed as threats. Telegram has refuted the claims, stating that it has no employees or servers in Russia and that its infrastructure remains fully under the control of its internal teams.

The company maintains that no third party, including vendors, can access confidential user data or systems. However, Telegram has yet to directly address the investigation’s core claims regarding GNM, Vedeneev, or the related infrastructure providers. The platform also hasn’t explained how it protects users if server operators have potential intelligence ties or why certain data is still sent without encryption.

The issue is especially relevant in Ukraine, where Telegram has over 10 million users and is a major source of news and official communication. While President Volodymyr Zelensky’s administration uses the app for public updates, growing concerns around disinformation and espionage have prompted discussions about its continued use.

As the investigation raises critical questions about the app’s security, the broader implications for global digital privacy and national security remain in sharp focus.

Ransomware Hackers Target SAP Servers Through Critical Flaw



 

Vulnerabilities and Exploits

China CISA IP Address Ransomware SAP Bug Vulnerabilities and Exploits

Ransomware Hackers Target SAP Servers Through Critical Flaw

A newly discovered security hole in SAP’s NetWeaver platform is now being misused by cybercriminals, including ransomware gangs. This flaw allows attackers to run harmful commands on vulnerable systems from a distance—without even needing to log in.

SAP issued urgent software updates on April 24 after learning about the flaw, found in NetWeaver’s Visual Composer tool. The weakness, labeled CVE-2025-31324, makes it possible for attackers to upload files containing malware. Once inside, they can take full control of the affected system.

ReliaQuest, a cybersecurity firm that tracked this issue, now says that two known ransomware groups, RansomEXX and BianLian have joined in. Although they haven’t yet successfully launched any ransomware in these cases, their involvement shows that multiple criminal groups are watching this flaw closely.

Investigators linked BianLian to at least one incident using an IP address tied to their past operations. In another case, RansomEXX attackers used a backdoor tool called PipeMagic and also took advantage of a previously known bug in Microsoft’s Windows system (CVE-2025-29824).

Even though their first effort didn’t succeed, the attackers made another attempt using a powerful hacking framework called Brute Ratel. They delivered it using a built-in Microsoft function called MSBuild, which helped them run the attack in a sneaky way.

More recently, security teams from Forescout and EclecticIQ connected this activity to hackers linked to China. These groups, tracked under various names, were also found to be exploiting the same SAP vulnerability. In fact, they managed to secretly install backdoors on at least 581 SAP systems, including some tied to national infrastructure in the US, UK, and Saudi Arabia. Their plans may also include targeting nearly 2,000 more systems soon.

Experts believe these hidden access points could help foreign state-sponsored hackers gather intelligence, interfere with operations, or even achieve military or economic goals. Since SAP systems are often connected to important internal networks, the damage could spread quickly within affected organizations.

SAP has also fixed another weakness (CVE-2025-42999), which had been silently misused since March. To stay safe, system administrators are advised to apply the patches immediately. If they can’t update right away, disabling the Visual Composer tool can help. They should also restrict access to certain features and monitor their systems closely for anything unusual.

The US government’s cyber agency CISA has officially listed this flaw as a known risk. Federal departments were told to patch their systems by May 20 to avoid falling victim.

Coordinated Action Targets DDoS-for-Hire Empire with Arrests and Seizures



 

Targeted DDoS

Cyber Arrest Cyber Security CyberCrime Cyerhackers FBI IP Address seizure Targeted DDoS

Coordinated Action Targets DDoS-for-Hire Empire with Arrests and Seizures

The Polish authorities have succeeded in dismantling a sophisticated criminal network offering distributed denial-of-service (DDoS) for-hire services to hit the cybercrime infrastructure hard. As the result of a coordinated operation, four people were arrested who were suspected of operating a number of illegal platforms which helped facilitate thousands of cyberattacks in the world.

It is believed that the accused was responsible for six different stressors and booters, namely Cfxapi, Cfxsecurity, Neostress, Jetstress, Quickdown, and Zapcut, which allowed users to launch DDoS attacks at a minimum of €10. During the period 2022-2025, these platforms were designed with ease of use in mind, so that any individual, regardless of their level of technical expertise, could be able to carry out large-scale cyberattacks.

A user was only required to enter a target IP address, choose the type and duration of an attack, and then submit payment. The service would then flood that system with excessive traffic, disrupting or disabling access to websites and digital infrastructure.

An extensive range of targets had been compromised in these attacks, including educational institutions, governmental organizations, private companies, and servers that hosted online video games. With the enforcement action, the international community has made a major strides in curbing the growing threat of for-hire cyberattack services, which continues to pose significant risks to the security and stability of the Internet.

When the suspects were arrested, authorities were able to reveal that they were directly connected to six DDoS-for-hire services, which are alleged to have enabled thousands of cyberattacks since the year 2022. An extensive range of targets were targeted by these attacks, including educational institutions, government organizations, private businesses, as well as online gaming platforms around the world.

In response to an international coordinated takedown, the platforms were taken down in the form of Cfxapi, CfxSecurity, NeoStress, JetStress, QuickDown, and ZapCut. Even though these services are often promoted as legitimate stress testing tools on the dark web and underground hacking forums, they are primarily exploited to carry out malicious distributed denial of service attacks (DDoS) against websites and servers.

With the help of such attacks, websites, servers, or networks are overwhelmed with an excessive amount of fake traffic that renders them inaccessible to genuine users, causing significant financial losses and disruptions to businesses. As a result of a collaborative effort among law enforcement agencies from Poland, Germany, the Netherlands, and the United States, the takedown operation highlighted the growing commitment globally to the dismantling of cybercrime networks and protecting digital infrastructure to prevent cybercrime.

In all, six illicit DDoS-for-hire platforms have been accused of operating by those arrested, aged between 19 and 22 years old. These platforms include Cfxapi, CfxSecurity, NeoStress, JetStress, QuickDown, and ZapCut. As a result of these services, individuals could access powerful distributed denial-of-service (DDoS) attacks for as little as €10. Using these platforms, anyone could disrupt any digital infrastructure with little effort on their part.

Since their introduction in 2022, these platforms have been implicated in attacks that have targeted schools, government websites, private companies, and gaming networks. As per the Central Cybercrime Bureau of Poland (CBZC), the suspects could end up serving a prison sentence of up to five years. It has been reported that law enforcement officers conducted coordinated raids throughout the country, in which a range of digital and physical assets, including computer equipment, mobile phones, SIM cards, payment cards, cryptocurrency wallets containing approximately $30,500 in digital currency, as well as cash and several vehicles, have been seized.

In contrast with conventional botnet-based attacks, these "booter" or "stresser" services utilize rented infrastructure instead of conventional botnets, allowing users who lack technical expertise to launch disruptive attacks simply by entering the target's IP address and submitting payment, without any additional technical expertise or training.

In consequence of this streamlined model, cybercriminals have had a significant drop in the barrier to entry, and the frequency and scale of attacks have increased as well. As part of the global crackdown Operation Poweroff spearheaded by Europol and the FBI, as well as participation from law enforcement agencies from several countries, the arrests are part of the latest phase of this crackdown. Authorities seized nine domains that were associated with illegal DDoS-for-hire services as part of the latest phase.

During a December 2024 operation, a total of 27 such platforms across 15 countries were shut down, 300 users were identified, and three administrators in France and Germany were arrested for using these platforms. In recent years, there has been a marked increase in both the level of technical sophistication and the operational scale of the DDoS-for-hire platforms.

A notable example is QuickDown's botnet add-on, released in 2023, which allows users to rent compromised networks, thus increasing their attack capabilities significantly. It is becoming increasingly common for platforms like QuickDown to deploy hybrid infrastructures that combine botnets of infected Internet of Things (Iot) devices with proxy networks built on the cloud, dedicated offshore servers, and geo-rotating IP addresses.

It is well known that the multifaceted architecture of the Internet greatly increases the intensity and duration of attacks, but it also complicates attempts to trace their sources in a very significant manner. There have been several documented instances in which targeted organisations have been subjected to sustained DDoS attacks lasting for days on end. It is common for these campaigns to use a combination of attack vectors to overload and deplete systems' resources, targeting DNS servers, firewalls, and web application firewalls (WAFS) in succession.

Despite their complexity and persistence, these types of attacks are still posing a significant threat to organizations, which is why it is so important to be prepared for them. Taking down major DDoS-for-hire platforms is a significant victory for international law enforcement, however experts warn that the victory is mostly tactical in nature, rather than a comprehensive one. There is no doubt that it disrupts the criminal infrastructure and serves as a deterrent, but the broader challenge remains.

Despite the fact that these platforms can be easily recreated, often operating across multiple jurisdictions, and there are new domains popping up every day to take their place from those that have been shut down, cybercriminals are constantly adapting and their infrastructure is decentralised, which is why they are outpacing current enforcement efforts. However, even though this operation represents a significant victory, it is just one step in what has been a long-term campaign against an increasingly agile cyber threat landscape that is constantly evolving.

The coordinated crackdown included the issuance of cease-and-desist orders by law enforcement agencies across the globe to users of DDoS-for-hire services. Among the warnings was the fact that they made it clear that participating in or enabling cyberattacks would result in legal consequences, as well as dispelling the myth that users could be anonymous by using cryptocurrencies and virtual private networks, as these technologies are not meant to protect individuals from identification.

This operation has been widely praised by cybersecurity professionals, who view it as an important step in weakening the infrastructure that supports DDoS-for-hire companies. A key component of the enforcement effort is the targeting of both service providers and end users, disrupting the broader supply chain of cybercrime.

An analyst from the Polish threat intelligence community noted that "Every seized domain, every arrested administrator, and every dismantled digital wallet adds friction to these illicit operations," thus indicating that "this initiative is not only a means of deterrence but also a means of enforcement." There has been a reaffirmation by authorities that sustained action is essential, and Europol and the Polish Central Cybercrime Bureau have indicated that more arrests and domain seizures will likely take place as investigations advance.

Furthermore, organizations worldwide are being urged to improve their strategies for addressing DDoS attacks and to report any suspected cyberattacks as soon as possible. A significant milestone in the battle against cybercrime has been reached with the takedown of this DDoS-for-hire operation, but continued vigilance and international cooperation remain crucial to counteract the ever-evolving threat landscape.

For the future, the dismantling of this DDoS-for-hire operation will likely serve as a wake-up call for government entities and private businesses alike to reevaluate the cybersecurity postures they have in place and invest proactively in robust digital defences. The role of law enforcement in disrupting cybercriminal infrastructure is critical, but for a system to be long-lasting resilient to such threats, it requires a shared responsibility approach—one in which governments, technology providers, business organizations, and end users all work in tandem to identify vulnerabilities, share threat intelligence, and implement timely countermeasures promptly.

Whenever an incident occurs, organisations must respond immediately rather than wait for it to escalate. The solution must be to adopt a proactive approach to incident response and recovery, which includes conducting regular risk assessments of the company, deploying adaptive DDoS mitigation tools, educating employees about how to respond to attacks, and establishing clear protocols for incident responses and recovery.

Moreover, the regulatory environment must evolve at the same time as the threat landscape so that legal loopholes can be closed and cross-border cooperation can be conducted swiftly. As digital systems become increasingly interconnected and vital to everyday functioning of a society, complacency has become a necessity. There is a key opportunity here, not just in celebrating tactical victories, but also in thinking about collective strategies in order to build a more secure, resilient, and safe ecosystem for the future that is based on cyber-security and resilience.

Fast Flux Technique Identified as Growing Risk to US Cyber Infrastructure



 

IP Address

CNAME Cyber Security Cyberattacks CyberCrime CyberThreat DNS attacks Fast Flux IP Address

Fast Flux Technique Identified as Growing Risk to US Cyber Infrastructure

A sophisticated cybercriminal technique called fast flux is being increasingly employed by cybercriminals, which is causing heightened concerns among intelligence agencies and cybersecurity agencies throughout the world.

It has been reported in April 2025 that the United States National Security Agency (NSA), in conjunction with allied organizations, has issued a joint cyber advisory warning that fast flux poses a serious threat to national security, as a result of the use of fast flux. As per the advisory, using this technique allows both criminals and state-sponsored threat actors to create command-and-control infrastructures (C2) that are highly resistant to detection and disruption, and that are very difficult to detect or disrupt.

As a result, the IP addresses of malicious domains are frequently rotated through a network of compromised systems, known as botnets, to create a continuous flow of malicious IP addresses. Defending against cyberattacks is extremely challenging due to the constant flux of IP addresses. This makes it extremely difficult for defenders to identify, track, or block the infrastructure supporting those attacks.

Therefore, adversaries can conceal their actions and maintain persistent access to targeted systems and networks. It was noted by the National Intelligence Agency that this technique has been employed to facilitate a wide range of malicious operations, such as cyber espionage, phishing schemes, ransomware deployments, and other forms of cybercrime as well. As fast flux is increasingly being adopted by threat actors, it underscores the need for advanced defensive measures, as well as increased international collaboration, in the fight against emerging cyber threats.

Fast flux is a DNS-based obfuscation technique increasingly used by cybercriminals to evade detection and disrupt conventional security measures to avoid detection. This method of cloaking the true location of malicious servers, as it rapidly alters the IP addresses associated with a domain name, makes it very difficult for cybersecurity teams to identify and eliminate malicious servers.

By utilizing DNS's dynamic nature, the technique can keep malicious infrastructure running smoothly even when individual IP addresses and servers are discovered and taken down, while utilizing DNS's dynamic nature. It has been found that fast flux can be divided into two distinct types: single flux and double flux. A single flux is defined as a continuous rotation of the IP addresses associated with a domain name. This process usually draws from a large pool of compromised machines to maintain the integrity of the domain name.

A double flux adds to this complexity by rotating the authoritative name servers as well, further complicating the infrastructure and making tracking harder. By taking advantage of this dynamic and distributed approach, attackers can build highly resilient command-and-control networks based on a global network of infected devices that are capable of maintaining operations for a long time.

It is a variant of fast flux that introduces a layer of obfuscation and network resiliency to the network by rotating not only the IP addresses that point to a malicious domain, but also the DNS name servers that conduct domain lookups. Double flux adds a level of obfuscation and network resilience. As a result of this method, it becomes much more challenging for cybercriminals to track and dismantle their networks.

As a result of security analysis, it has been found that DNS records from both Name Server (NS) and Canonical Name (CNAME) are used in double flux configurations, making it even more difficult to trace the root cause of malicious activity. According to a recent advisory issued on Thursday, both single flux and double flux techniques make use of vast networks of compromised hosts that act as proxies and relays, commonly called botnets.

Consequently, network defenders are unable to identify, block, or pursue legal actions against the infrastructure supporting cyberattacks because of this distributed architecture. Fast flux, with its persistence and evasiveness, has become one of the most popular tactics among cybercriminals as well as government agencies and foreign governments alike. In the world of cyber threats, it has proven its strategic value and prevalence as well as its increasing prevalence.

To differentiate themselves within the illegal marketplace, bulletproof hosting services, which are geared specifically towards criminal enterprises, use fast flux as part of their operation to harden their operations and distinguish themselves from their competitors. Several ransomware groups, such as Hive and Nefilim, have implemented fast flux into their campaigns to retain control over their infrastructure while avoiding detection by the authorities.

Moreover, it has been documented that Russian-backed Gamaredon, a group of threat actors associated with the Kremlin, used the technique as part of their cyber espionage activities, highlighting its appeal to state-allied actors involved in geopolitical cyber operations. Cybersecurity experts recommend that a multifaceted defence strategy be developed to prevent fast flux from posing any threat.

Several key measures include blocking known malicious IP addresses, sinkholing suspicious domains for disruptions in attacker communications, filtering traffic according to domain reputation, and training targeted users about phishing techniques and social engineering. It is crucial to monitor DNS activity constantly for anomalies or strange patterns to detect fast flux networks in advance of their ability to inflict significant damage.

As a result of fast flux deployment, command-and-control (C2) communications are not the only applications that can be made use of to maintain command-and-control communications—it can also play a crucial role in enabling phishing campaigns by making malicious websites used to conduct social engineering attacks much more difficult to detect, block, or compromise. This method of attack enables phishing infrastructure to persist more effectively by rotating IP addresses and obscuring server locations, giving hackers greater ease in bypassing traditional filtering and takedown mechanisms.

Furthermore, bulletproof hosting providers are increasingly promoting fast flux as a distinguishing feature in their services, since they can offer resilient and anonymous infrastructure to criminals. A fast flux service provider markets itself as providing a value-added capability that enhances the effectiveness and survivability of malicious operations, such as malware distribution, credential theft, and ransomware deployment.

In April 2025, a coalition of international cybersecurity authorities issued a joint Cybersecurity Advisory (CSA) to address the growing threats posed by fast-flux networks. As part of the advisory, the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) have collaborated.

Among the Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC), the Canadian Centre for Cyber Security (CCCS), and the National Cyber Security Centre for New Zealand (NCSC-NZ), there is the Australian Signals Directorate's Australian Cyber Security Centre. As a result of the collaborative effort, it has been made clear that fast flux techniques have global implications and that cross-border coordination is essential to combating this evolving cyber threat.

As a result of the growing threat of fast flux techniques, the participating agencies are strongly recommending implementing a comprehensive, multilayered defence strategy so that attacks are detected and mitigated accordingly. It is important to utilise real-time threat intelligence feeds to identify suspiciously short DNS record lifespans. Furthermore, anomaly detection across DNS query logs can be implemented, along with DNS record time-to-live (TTL) values being analysed to identify anomalies.

Network flow data can also help in the early detection of malicious activity, as it can be used as an indicator to identify inconsistent IP geolocations and irregular communication patterns. According to the advisory, several critical mitigation strategies can be used to protect enterprises and organisations from cyber threats. These include blocking domains and IP addresses, reputational filtering of DNS traffic, monitoring and logging of network activity, and educating users about the importance of phishing awareness.

As part of the guidance, it is stressed that collaboration with Internet Service Providers (ISPS), cybersecurity vendors, and particularly Protective DNS (PDNS) providers is essential to ensuring that these countermeasures will be implemented effectively. The coordination of efforts between infrastructure providers is essential to reduce the operational effectiveness of fast flux networks, as well as disrupt the cybercriminal ecosystem which is based on them.

Firewalls and VPNs Under Siege as Businesses Report Growing Cyber Intrusions



 

zero Day vulnerability

Cyber intrusion Cyber Security CyberThreat DDoS FortiGate IoT IP Address Networkk Infrastructure ransomware-as-a-service (RaaS) VPN Vulnerabilities Firewalls zero Day vulnerability

Firewalls and VPNs Under Siege as Businesses Report Growing Cyber Intrusions

A security researcher has discovered an ongoing cyberattack that is active, exploiting a newly discovered vulnerability in Fortinet's FortiGate Firewalls to infiltrate corporate and enterprise networks and has been conducting this activity for some time. A security advisory published on Tuesday by Fortinet confirmed the existence of the critical security flaw known as CVE-2024-55591 and indicated that the vulnerability is currently being exploited in the wild.

Nevertheless, cybersecurity experts are voicing their concerns over the possibility that malicious actors are exploiting this flaw as a zero-day vulnerability - a term that refers to a software vulnerability exploited before the vendor is made aware of or has issued a patch for it. According to a report by Fortinet, attackers may have actively targeted this vulnerability since at least December, many months before it was publicly disclosed and patched.

In particular, organisations that heavily rely on FortiGate Firewalls for perimeter defence face a significant threat when the vulnerability is exploited by exploiting CVE-2024-55591. As a result of the vulnerability's criticality, enterprises should apply security updates as soon as possible and examine their systems for any indications of unauthorized access as soon as possible. Even though zero-day exploits remain a threat, this development highlights the fact that cybercriminals are increasingly focusing on foundational network infrastructure to gain a foothold in high-value environments.

The use of virtual private networks (VPNs) as a critical defence mechanism against a variety of cyber threats has long been regarded as a crucial aspect of protecting digital communications from a wide range of threats. VPNs are effective in neutralising the risks associated with man-in-the-middle attacks, which involve unauthorised parties trying to intercept or manipulate data while it is in transit by encrypting the data transmissions. Through this layer of encryption, sensitive data remains secure, even across unsecured networks.

One of the most prominent use cases for VPNs is that they serve the purpose of protecting people using public Wi-Fi networks, which are often vulnerable to unauthorised access. It has been shown that VPNs are significantly less likely to expose or compromise data in such situations because they route traffic through secure tunnels. Additionally, VPNs hide the IP addresses of users, thereby providing greater anonymity to users and reducing the possibility of malicious actors tracking or monitoring them.

As a result of this concealment, network resources are also protected against distributed denial-of-service (DDoS) attacks, which often use IP addresses as a method of overloading network resources. Even though VPNs have been around for decades, their use today does not suffice as a standalone solution due to the increasingly complex threat landscape that exists in today's society. To ensure comprehensive protection against increasingly sophisticated attack vectors, it is important to integrate their capabilities with more advanced, adaptive cybersecurity measures.

It seems that conventional security frameworks, such as Firewalls and VPN,s are becoming increasingly outpaced as the cybersecurity landscape continues to evolve due to the sophistication and frequency of modern threats, which have increased significantly over the past few years. Businesses across many industries are experiencing an increasing number of breaches and vulnerabilities, and traditional methods of addressing these vulnerabilities are no longer capable of doing so.

Due to the widespread transition from on-premises infrastructure to remote and digitally distributed work environments, legacy security architectures have become increasingly vulnerable, forcing enterprises to reassess and update their defence strategies. Firewalls and VPNs were once considered to be the cornerstones of enterprise network security; however, in today's increasingly complex threat environment, they are having trouble meeting the demands.

In the past, these technologies have played an important role in securing organisational boundaries, but today, the limitations of those technologies are becoming increasingly apparent as organisations transition to a cloud-based environment and undergo rapid digital transformation. In the year 2025, technological advances are expected to change the way industry operations are conducted—for instance, the adoption of generative artificial intelligence, automation, and the proliferation of Iot and OT systems.

Despite these innovations, there are also unprecedented risks associated with them. For example, malicious actors use artificial intelligence to automate spear-phishing efforts, craft highly evasive malware, and exploit vulnerabilities more quickly and accurately than they could previously. In addition, as Ransomware-as-a-Service (Raas) is on the rise, the barrier to entry for hackers is dropping, enabling a broader set of threat actors to conduct sophisticated, scalable attacks on businesses. To respond effectively to the complexities of a digitally driven world, organisations must adopt proactive, adaptive cybersecurity models that are capable of responding to the challenges of this dynamic threat environment and moving beyond legacy security tools.

There has been a significant shift in cybersecurity dynamics that has led to a worrying trend: malicious actors are increasingly exploiting Virtual Private Networks (VPNs) as a strategy to gain an advantage over their adversaries. Since VPNs were originally developed as a way to enhance privacy and protect data, they are increasingly being repurposed by cybercriminals to facilitate complex attacks while masking their identity digitally. Because VPNs are dual-purpose devices, they have become instruments of exploitation, which poses a significant challenge for cybersecurity professionals as well as digital forensics teams to deal with.

There is one particularly alarming technique for using VPN software to exploit vulnerabilities, which involves deliberately exploiting these vulnerabilities to bypass perimeter defences, infiltrate secure systems, and deploy malware without being it. When attackers identify and target these vulnerabilities, they can easily bypass perimeter defences, infiltrate secure systems, and deploy malware without being detected.

Frequently, such breaches act as entry points into larger campaigns, such as coordinated phishing campaigns that attempt to trick individuals into revealing confidential information. Further, VPNs are known for the ability to mask the actual IP addresses of threat actors, a technique known as IP address masquerading, which enables them to evade geographical restrictions, mislead investigators, and remain anonymous when they launch cyberattacks.

In addition to enabling adversaries to circumvent Firewalls, VPNs also offer the option of encrypting and tunnelling, thus enabling them to penetrate networks that would otherwise be resistant to unauthorised access with greater ease. As a matter of fact, VPNs are often used as a means of spreading malicious software across unreliable networks. By using an encrypted VPN traffic, malware can be able to bypass traditional detection methods, thereby circumventing traditional detection methods. The shield of anonymity provided by VPNs can also be used by threat actors to impersonate legitimate organisations and initiate phishing campaigns, compromising the privacy and integrity of users.

VPNs can also facilitate the spreading of Distributed Denial-of-Service (DDoS) attacks, which is equally troubling. As these networks are anonymised, it makes it difficult to trace the origin of such attacks, which hinders the development of appropriate response strategies and mitigation strategies. This paradox underscores the complexity of modern cybersecurity, since one security tool can serve both as a tool for cybercrime and a tool for security.

Even though VPNs remain an important tool to keep users safe and anonymous, their misuse requires a proactive and multifaceted response. To combat this misuse, people need robust technological defences combined with ongoing awareness and education initiatives, which will help us address this misuse effectively. Only through such comprehensive measures can organisations ensure the integrity of VPN technology and ensure trust in the digital privacy infrastructure as long as the technology remains intact.

Check Point has issued a formal warning regarding the active targeting of its VPN devices as part of an ongoing increase in cyber threats against enterprise infrastructure. As a result of this disclosure, people have been reminded again that there is a sustained campaign aimed at compromising remote access technologies and critical network defences. It is the second time in recent months that a major cybersecurity vendor has released such an alert in the past couple of months.

According to Cisco, in April 2024, organisations are being warned about a widespread wave of brute-force attacks against VPNs and Secure Shell (SSH) services that are likely to impact several devices from Cisco, Check Point, SonicWall, Fortinet, and Ubiquiti, among others. In the first observed attack around March 18, attackers used anonymised tools, such as TOR exit nodes, proxy networks, and other techniques to obfuscate and avoid detection and block lists, to launch the attacks.

In March of this year, Cisco had also noticed that passwords were being sprayed at their Secure Firewall appliances that were running Remote Access VPN (RAVPN) services. According to analysts, this is a reconnaissance phase, likely intended to lay the groundwork for more advanced intrusions to follow. Following a subsequent analysis by cybersecurity researcher Aaron Martin, these incidents were linked to a malware botnet dubbed "Brutus", which was previously undocumented.

Over 20,000 IP addresses were found to be associated with this botnet that was deployed from both residential and cloud-hosted environments, which greatly complicated the process of attribution and mitigation. The threat landscape has only been compounded by Cisco's announcement that a state-sponsored hacker group, also known as UAT4356, has been utilising zero-day vulnerabilities found within its Firepower Threat Defence (FTD) and Adaptive Security Appliances to exploit zero-day vulnerabilities.

Known by the codename ArcaneDoor, the cyber-espionage campaign has been ongoing since November 2023, targeting critical infrastructure networks as well as governments around the world as part of a broader cyber-espionage campaign. As the frequency and complexity of cyber attacks continue to increase, it is apparent that legacy perimeter defences are no longer adequate in terms of security.

A layered, intelligence-driven approach to security includes detecting threats in real time, hardening systems continuously, and responding to incidents in a proactive manner. As well as strengthening cybersecurity resilience, fostering collaboration between public and private sectors, sharing threat intelligence, and providing ongoing training to employees can make sure that they remain ahead of their adversaries. There is no doubt that the future of secure enterprise operations is going to be determined by the ability to anticipate, adapt, and remain vigilant in this rapidly evolving digital age.

Free VPN Big Mama Raises Security Concerns Amid Cybercrime Links



 

Proxy Service

Cyber Security DDoS DDOS Attacks Free VPN IP Address Network Security Privacy Risks Proxy Service

Free VPN Big Mama Raises Security Concerns Amid Cybercrime Links

Big Mama VPN, a free virtual private network app, is drawing scrutiny for its involvement in both legitimate and questionable online activities. The app, popular among Android users with over a million downloads, provides a free VPN service while also enabling users to sell access to their home internet connections. This service is marketed as a residential proxy, allowing buyers to use real IP addresses for activities ranging from ad verification to scraping pricing data. However, cybersecurity experts warn of significant risks tied to this dual functionality.

Teenagers have recently gained attention for using Big Mama VPN to cheat in the virtual reality game Gorilla Tag. By side-loading the app onto Meta’s Oculus headsets, players exploit location delays to gain an unfair advantage. While this usage might seem relatively harmless, the real issue lies in how Big Mama’s residential proxy network operates. Researchers have linked the app to cybercrime forums where it is heavily promoted for use in activities such as distributed denial-of-service (DDoS) attacks, phishing campaigns, and botnets. Cybersecurity firm Trend Micro discovered that Meta VR headsets are among the most popular devices using Big Mama VPN, alongside Samsung and Xiaomi devices.

They also identified a vulnerability in the VPN’s system, which could have allowed proxy users to access local networks. Big Mama reportedly addressed and fixed this flaw within a week of it being flagged. However, the larger problem persists: using Big Mama exposes users to significant privacy risks. When users download the VPN, they implicitly consent to having their internet connection routed for other users. This is outlined in the app’s terms and conditions, but many users fail to fully understand the implications. Through its proxy marketplace, Big Mama sells access to tens of thousands of IP addresses worldwide, accepting payments exclusively in cryptocurrency.

Cybersecurity researchers at firms like Orange Cyberdefense and Kela have linked this marketplace to illicit activities, with over 1,000 posts about Big Mama appearing on cybercrime forums. Big Mama’s ambiguous ownership further complicates matters. While the company is registered in Romania, it previously listed an address in Wyoming. Its representative, using the alias Alex A, claims the company does not advertise on forums and logs user activity to cooperate with law enforcement. Despite these assurances, the app has been repeatedly flagged for its potential role in cyberattacks, including an incident reported by Cisco Talos.

Free VPNs like Big Mama often come with hidden costs, sacrificing user privacy and security for financial viability. By selling access to residential proxies, Big Mama has opened doors for cybercriminals to exploit unsuspecting users’ internet connections. This serves as a cautionary tale about the dangers of free services in the digital age. Users are advised to exercise extreme caution when downloading apps, especially from unofficial sources, and to consider the potential trade-offs involved in using free VPN services.

VPN Server Switching: Benefits and Best Practices for Privacy and Speed



 

servers

Browsing Cybersecurity encrypted VPN server Internet Speed IP Address Privacy server security servers

VPN Server Switching: Benefits and Best Practices for Privacy and Speed

A VPN enhances online privacy by encrypting internet traffic and masking IP addresses. However, how often should you switch servers? The answer depends on your goals and usage patterns, as server hopping offers benefits but is not always necessary.

How VPN Servers Work

A VPN server acts as an intermediary between your device and the internet, creating an encrypted tunnel for your data. This ensures that your online activity remains private and your information is protected from hackers, ISPs, and other snoopers. The VPN server assigns a new IP address to mask your location and identity.

When to Switch VPN Servers

Switching servers can sometimes boost privacy in specific situations, such as for users facing surveillance or censorship. For most users, however, keeping the VPN connected to a single server is sufficient to maintain privacy. Regularly switching servers can disrupt your browsing experience without significantly enhancing security.

1. Bypassing Geographic Restrictions

One of the primary reasons for server switching is to bypass geographic restrictions. Many streaming platforms and websites restrict content based on location, but connecting to a server in a different country can help access otherwise unavailable material. This is particularly useful for travelers or those in regions with heavy internet censorship.

2. Specialized Servers for Specific Tasks

Some VPNs offer specialized servers for tasks like streaming, torrenting, or gaming. While these servers are optimized for specific activities, switching back to a general server after completing the task can provide a better overall experience for everyday browsing.

3. Improving Connection Speed and Stability

Server performance can vary based on factors like server load and proximity to your physical location. If a server is overcrowded or located far away, switching to a closer or less busy one can improve connection speed and stability. This is especially helpful for users seeking faster downloads or uninterrupted streaming.

4. Saving Money While Shopping

Server hopping can also help save money when shopping online. Many websites adjust prices based on the user’s location. By connecting to servers in different regions, you may find lower prices on flights, hotels, or products. Experimenting with various locations can help uncover better deals.

5. Resolving Access Issues

Access issues can arise when certain VPN IP addresses are flagged or blacklisted due to misuse by other users. In such cases, switching to a different server can resolve the problem. Some VPNs also offer dedicated IP addresses for an additional fee, reducing the risk of being blocked.

When Not to Switch Servers

Despite these advantages, most users don’t need to switch servers frequently. A consistent connection to a single server already provides privacy and security benefits. Unless you’re trying to bypass geo-restrictions, troubleshoot access issues, or improve connection speed, sticking to one server is generally sufficient.

Conclusion

Ultimately, server hopping is a useful feature for those with specific needs but isn’t essential for everyday VPN use. By understanding how and when to switch servers, you can make the most of your VPN experience while maintaining privacy and performance.

Windows PCs at Risk as SteelFox Malware Targets Driver Vulnerabilities



 

Windows PC

Cyber Vulnerabilities CyberCrime Cybersecurity IP Address Kaspersky malware STeelFox Windows Windows PC

Windows PCs at Risk as SteelFox Malware Targets Driver Vulnerabilities

Several experts have warned that hackers are using malware to attack Windows systems with the intention of mining cryptocurrency and stealing sensitive information from their devices. The latest Kaspersky Security Report claims to have spotted tens of thousands of infected endpoints. Cybercriminals have obtained fake cracks and activators for several commercial software products, such as Foxit PDF Editor, JetBrains, or AutoCAD, which they are selling to users.

There is a vulnerability in a driver called WinRing0.sys that is associated with some fake cracks. The victim of this attack has reintroduced the CVE-2020-14979 and the CVE-2021-41285 vulnerabilities back onto the system by adding this driver at the same time, two three-year-old vulnerabilities that extended the privileges of the attacker to the maximum possible.

SteelFox is a malware package that has been designed to mine cryptocurrency and steal credit card details via SYSTEM privileges by taking advantage of the "bring your own vulnerable driver" attack method. In forums and torrent trackers, malware bundle droppers appear as crack tools. These tools act as crack tools that activate legitimate versions of various software, such as Foxit PDF Editor, JetBrains, and AutoCAD.

To evade detection and evade detection, state-sponsored threat actors and ransomware groups are known to exploit vulnerable drivers to escalate privileges. As of late, however, this method seems to be extended to attack against information-stealing malware as well. According to Kaspersky researchers, the SteelFox campaign was discovered in August of this year, but they add that the malware has been active since February 2023 and has been distributed through various channels (such as torrents, blogs and forum posts) in the past few weeks.

The Rhadamanthys data theft malware has been available for download for some time, but since July 2024 the virus' version has been updated with copyright-related themes in an ongoing phishing campaign. There is a large-scale cybercrime campaign being tracked by the checkpoint group under the name CopyRightAdamantys. In addition to targeting the U.S., Europe, East Asia, and South America, the organization targets other regions as well.

The campaign tries to impersonate dozens of companies, while each email is sent from a different Gmail account, providing a tailored impersonation of the target company as well as a tailored language based on the targeted entity, according to a technical analysis provided by the company. In the case of impersonated companies, there is almost 70% of them from the entertainment/media/technology/software sector."

There is an element that stands out about the attacks: the deployment of the Rhadamanthys stealer version 0.7, which, as described by Insikt Group, Recorded Future's security division, early last month, is utilized to carry out optical character recognition. Cisco Talos, an Israeli company that specializes in cyber security, disclosed last week that it had been targeting users of Facebook business and advertising accounts in Taiwan by delivering malware known as Lumma or Rhadamanthys, which is designed to steal information.

There are three components inside the RAR archive. A legitimate executable vulnerable to DLL side-loading, a malicious DLL containing the stealer payload, and a decoy document containing the stealer payload. After the binary has been executed, it will sideload the DLL file that will create the environment that will allow Rhadamanthys to be deployed. It is likely that the threat actors were using artificial intelligence tools to spread the malware, based on both the scale of the campaign and the variety of lures that were included in the campaign and the emails sent by the sender, which Check Point attributed to a possible cybercrime group.

It seems likely that this campaign was orchestrated by a financially motivated cybercrime group and not a nation-state actor, particularly given the large number of organizations across multiple regions targeted in this campaign," he continued. In addition to its global reach, the use of automated phishing tactics, and the use of a variety of lures, this campaign demonstrates how attackers continue to enhance their success rates."

As part of these findings, Kaspersky also revealed a full-featured crimeware bundle dubbed SteelFox, which has been spreading via forums posts, torrent trackers, and blogs, passing itself off as legitimate utilities like Foxit PDF Editor, JetBrains, and AutoCAD in order to steal personal information. In the last two years, the campaign of terrorism has claimed victims in nearly 50 countries. The majority of the victims were in Brazil, China, Russia, Mexico, the United Arab Emirates, Egypt, Algeria, Vietnam, India, and Sri Lanka, with many more in Brazil, China, Russia, and Mexico.

At this point in time, there is no known threat actor or group associated with this attack. A security researcher, Kirill Korchemny, said: "Delivered via sophisticated execution chains, notably shellcode, this type of malware abuses both Windows services and drivers in an attempt to accomplish its objectives." As a result of it, he said that he used stealer malware to obtain details about the victim's device as well as his credit card information.

A dropper program is the starting point of this setup, in the sense that it mimics cracked versions of popular software, so when it is run, the dropper application will request administrator permissions and drop a next-stage loader which, in turn, will establish persistence and launch the SteelFox module. It is Kaspersky's opinion that although SteelFox's C2 domain is hardcoded, it has managed to conceal its presence through the use of multiple IP addresses and using DNS over HTTPS to resolve its IP addresses in order to hide its presence. Although SteelFox attacks don't have specific targets, they seem to focus on users of AutoCAD, JetBrains, and Foxit's Adobe PDF Editor app.

In accordance with Kaspersky's visibility information, Kaspersky indicates that the malware is compromising systems in Brazil, China, Russia, Mexico, the UAE, Egypt, Algeria, Vietnam, India, and Sri Lanka among others. Researchers have identified a new and potent cyber threat: the SteelFox malware, a sophisticated crimeware bundle targeting Windows PCs through vulnerable drivers. This malware, still relatively new to the landscape, demonstrates advanced functionality and appears to be the product of a skilled C++ developer who has integrated multiple external libraries to enhance its capabilities.

In a related development, analysts from FortiGuard Labs have reported the discovery of another malicious software framework named Winos4.0. This advanced framework, embedded in game-related applications, is engineered specifically to target Windows users. Originating as an evolved version of the Gh0strat malware, Winos4.0 enables attackers to remotely execute various actions, providing them with substantial control over compromised systems. The infection process for Winos4.0 is particularly deceptive.

It spreads through game-related applications, such as installation utilities and performance enhancement tools, designed to appeal to gamers and other Windows users. Once an individual downloads and installs one of these compromised applications, a seemingly harmless BMP file is retrieved from a remote server. This file subsequently extracts and activates the Winos4.0 DLL file, initiating the malware’s operations.

In its initial phase, Winos4.0 sets up an environment for deploying further modules and establishes persistence on the infected machine by modifying system registry keys or creating scheduled tasks. Through this multi-stage infection process, Winos4.0 builds a durable foothold on affected devices, opening avenues for continuous exploitation and control.

Shocking Ways Hackers Can Exploit Your IP Address – You’re Not as Safe as You Think



 

phishing

DDOS Attack Hackers IP Address Personal Data phishing

Shocking Ways Hackers Can Exploit Your IP Address – You’re Not as Safe as You Think

Your IP address may look like a long number row, but to a hacker, it can be an instrument of evil activity. While your exposure to an IP doesn't pose an immediate danger per se, it is thus important to understand what a hacker can do with it. Let's break down how cybercriminals can exploit an IP and how you can keep it safe.

Determining Your Broad Area of Location

The very first thing a hacker will easily know once he has obtained your IP address is your general area of location. He can find out your city or region using even simple online tools such as IP tracking websites. Of course, he won't pinpoint the street number but can already pinpoint your general area or location which may trigger other related hacking attempts such as phishing attacks. Hackers would use your address and ISP to dupe you through social engineering.

IP Spoofing: Identity Mimicry Online

The hacker can manipulate the IP addresses and make it seem like the actions they are performing are coming from your device. In this method, which is known as IP spoofing, hackers perpetrate various illegal activities while concealing identities. Many people employ IP spoofing in DDoS attacks whereby hackers inject tremendous amounts of traffic into a network to actually shut it down. Using your IP address during this attack may keep them undetected while they wreck the damage.

Selling Your IP Address

One seems minute, but hackers sell bundles of thousands of IP addresses in bulk across the dark web, and those addresses can be used in large-scale social engineering projects that lead to data theft. Used with other personal data, your IP address can be a wonderful commodity in some hacker's arsenal, allowing them to crack into almost any online account.

Scanning for Further Information

Using this method, and with the use of such tools as Nmap, hackers can not only obtain your IP but also uncover which OS your machine is running, applications that are installed, and open ports. If vulnerabilities exist in your system, they can launch specific attacks on those particular weaknesses, which will then allow them to get into your network, and even control your devices.

A DDoS attack

Although it is seldom that DDoS attacks any user, hackers can use your IP to attack you using DDoS, which will turn your device into a traffic flooder and take it offline. Such attacks are usually employed in larger organisations, although those engaging in activities such as online gaming and other competitive activities are also at risk. For instance, some players have used DDoS attacks to cut off their opponents' internet.

How to Hide Your IP Address

The likelihood that someone actually targeted you may be low, but this is equally as important to adhere to these safety precaution guidelines. With a virtual private network or a proxy server, your public IP address remains hidden, which makes it extremely hard for hackers to find and take advantage of it. It can also protect your devices by updating them as regularly as possible and using firewalls.

It is important to note that knowing an IP address doesn't give hackers total control over your system. However, it can be part of a scheme that encourages them to come closer to extracting more personal information or conducting attacks. However, usually there's little chance that someone would go out of his way to harm you using just your IP address; still, you can never be too safe. Securing the network and masking the IP simply reduces these risks from IP-based attacks.

Care needs to be taken, and preventative measures need to be in place so that nobody would use those malpractices against you.

Doxing: Is Your Personal Information at Risk?



 

Spam

Doxing Email address IP Address Privacy Sensitive data Spam

Doxing: Is Your Personal Information at Risk?

Doxing is the online slang for "dropping documents," which means revealing private information about a person or his identity to the public without his permission. It may be as simple as a person's name, e-mail, or phone number, but it can also include confidential data like financial information, home addresses, and even personal photos. Typically, hackers or cybercrooks do this with the aim of causing harm to that person, either through identity theft, fraud, or embarrassment.

The methods are varied, from hackers involving social media platforms or public databases in obtaining personal information to others using phishing techniques to get sensitive information from unsuspecting individuals. Once out of a computer within, it is no longer within one's control, and the impacts may be dire, touching on every point in an individual's life.

Impact of Doxing on Victims

With private information made public, victims of such situations can easily become victimised with harassment, identity theft, and other kinds of exploitative activities. In many cases, it just feels like a privacy violation; this can evoke feelings of vulnerability and betrayal. Even if the individual responsible is unknown to the victim, they may feel as if they are always in danger.

The extent of damage would also depend on the type of information that is leaked. For instance, if one accesses financial information, then the victims would lose their money when financially victimised to fraud and theft. It is in sensitive photos or private details where reputations get adversely tainted, relationships get harmed in society, or even employment loss. Sensitive data like online search histories can, in extreme cases, lead to even worse consequences: public humiliation.

Why You Shouldn't Leak Your Email Address

You might think that nothing substantial can be generated from your email address, but believe me, it has a fair amount of valuable information attached to it. I mean, sure, you share it with your friends, family, or maybe some business that's running loyalty programs or will mail you receipts. But would you like everyone in the world to have access to it? I didn't think so. Once you send out your email, cyber thieves have an open opportunity to flood your inbox with spam, phishing attempts, or risky malware disguised as legitimate messages. In case you click on any of these links and accidentally let a cyber thief steal your device, it may be compromised.

Beyond spam, hackers can use your email to forge accounts in your name, damaging your reputation online. How dangerous the simple act of gaining access and maliciously using your email address is becomes clear when considering that even the smallest piece of personal information can be dangerous.

Examples of Real Doxing Impact in Life

The outcomes of doxing, at least in some well-publicised instances, can be catastrophic. For Claira Janover, a satirical video that she shot actually found its way onto the internet and led to death threats, including even publicising her home address. She was forced to change her address. Even Deloitte-the firm that had already hired her-now rescinded their job offer, given some online activity that was associated with her professional profile.

The same instance comes in the form of the 2013 Boston Marathon bombing investigation. Here, internet communities like Reddit and 4Chan branded innocent people with incorrect accusations. The anguish of misidentified families had to be bearable while their loved ones' names streamed online as wrongly linked to the attack. These prove that doxing does not only hack privacy but could also have life-altering results.

How to protect yourself from Doxing

Being doxed is inevitable for everyone, but there are many things you can do to avoid falling victim. The number one and perhaps most relevant is practising good cyber safety: lock up the doors, so to speak. Keep your social media accounts private and be very selective of who follows or is connected to you online. Regularly check on your privacy settings and ensure that no one can access sensitive information about you in public media.

This can be enhanced by masking your IP address with a VPN (Virtual Private Network) while making a separate email account for communication, shopping, and all the professional work you do online. Clicking on any suspicious link at any time can harm you: never do it, not even if it looks legit.

Doxing is a serious form of cybercrime, which has deep and far-reaching effects on a victim's personal and professional life. The important thing for an individual to know is that being aware of the danger and taking proactive steps to protect your information is enough to lower the bar for such an attack. Digital privacy protection is the need of today.

Understanding the Domain Name System (DNS): How It Works and Why It Matters



 

third party

Cyber Security Cyber Threats Risk Digital Infrastructure DNS DOH Domain Name System domains IP Address third party

Understanding the Domain Name System (DNS): How It Works and Why It Matters

The Domain Name System (DNS) serves as a critical element of the internet’s infrastructure, acting like a phone book that translates human-friendly domain names into the numerical IP addresses that computers use to communicate. Without DNS, accessing websites would be far more complicated, requiring users to remember lengthy strings of numbers instead of simple names like “google.com.” When you enter a website URL into your browser, the DNS process begins. This request, known as a “DNS query,” first goes to a DNS resolver—typically provided by your Internet Service Provider (ISP) or a third-party DNS service like Google Public DNS or Cloudflare.

The resolver acts as an intermediary, starting the process to find the corresponding IP address of the domain name you’ve entered. The DNS resolver contacts one of the 13 root servers that make up the top level of the DNS hierarchy. These servers don’t hold the IP address themselves but provide information about which “Top-Level Domain” (TLD) server to query next. The TLD server is specific to the domain extension you’ve entered (e.g., “.com,” “.net,” “.org”) and points the resolver to the authoritative name server responsible for the particular website. The authoritative name server then provides the IP address back to the resolver, which, in turn, sends it to your browser.

The browser then connects to the web server using this IP address, loading the website you want to visit. This process, though complex, happens in milliseconds. Security is a vital aspect of DNS because it is a frequent target for cyberattacks. One common threat is DNS spoofing, where attackers redirect traffic to fraudulent websites to steal data or spread malware. DNS hijacking is another risk, where hackers manipulate DNS records to divert users to malicious sites. These threats emphasize the importance of DNS security protocols like DNS over HTTPS (DoH) and DNS over TLS (DoT), which encrypt DNS requests to prevent interception by malicious entities, thus protecting users’ data and privacy.

Switching to a third-party DNS service can enhance your internet experience in terms of speed, reliability, and security. Services like Google Public DNS, OpenDNS, or Cloudflare’s 1.1.1.1 offer faster query response times, better privacy protection, and can help circumvent geographical restrictions imposed by ISPs. These alternatives often provide built-in security features, such as blocking malicious sites, to offer an extra layer of protection.

DNS is the backbone of internet browsing, seamlessly converting domain names into IP addresses. By understanding its role and the importance of security measures, users can better appreciate how DNS keeps the internet functional and secure. Whether ensuring that websites load correctly or protecting against cyber threats, DNS plays an indispensable role in our everyday online activities.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About