InfoSecBulletin Cybersecurity for mankind
Attackers are pretending to be Ukraine’s Computer Emergency Response Team (CERT-UA) using AnyDesk to access target computers.
“Unidentified individuals are sending connection requests via AnyDesk under the pretext of conducting a ‘security audit to verify the level of protection,’ using the name ‘CERT.UA,’ the CERT-UA logo, and the AnyDesk ID “1518341498” (which may vary),” CERT-UA explained on Friday.
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
The requests appear to be haphazardly sent, with the attackers relying on users to accept them without skepticism: “It is evident that attackers are once again resorting to social engineering methods based on trust and the use of authority.”
To send a connection request, the attacker must know the target’s AnyDesk ID and the remote access software must be operational on their device.
They think the attackers may have obtained the targets’ AnyDesk IDs by compromising other computers where remote access was previously allowed.
AnyDesk and other remote access tools are often leveraged by a variety of attackers to gain access to target computers.
Ukraine’s national CERT uses remote access tools to help users combat and manage cyber incidents. These interventions are done only through pre-approved communication channels. A connection requests out of the blue should, therefore, raise potential targets’ suspicions.
The team is unsure if the targets are government workers, company employees, or private individuals. They advise anyone receiving such connection requests to report them to relevant cyber protection units or CERT-UA.
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025
