CVE-2024-11667
Hackers actively exploiting Zyxel firewall to deploy Ransomware

CERT Germany and Zyxel have alerted about a serious vulnerability in Zyxel firewalls, identified as CVE-2024-11667. This flaw is being exploited to spread Helldown ransomware, with reports of at least five affected organizations in Germany.

CVE-2024-11667 is a directory traversal vulnerability in Zyxel’s ZLD firmware versions 5.00 to 5.38. Exploiting it allows attackers to upload and download files using crafted URLs, which can compromise sensitive information like system credentials. This may lead to further attacks, such as creating rogue VPN connections and changing firewall settings.

• Hot Topic

Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom

By infosecbulletin / Tuesday , November 10 2026

A jailbroken AI has been attacking a European telecom company and 13 companies using its data center and cloud for...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 10.11. 2026

By infosecbulletin / Tuesday , November 10 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Alert

IBM fixes 208 API Connect vulnerabilities, 47 critical

By infosecbulletin / Tuesday , November 10 2026

IBM patched 208 security flaws in its API Connect platform. The CVE records released out on November 7, 2026. Among...

Read More

• Ransomware

89 New ransomware groups emerge in 2026, claiming over 2,200 victims

By infosecbulletin / Sunday , November 8 2026

New ransomware actions in 2026 show more variety in cybercrime, with some groups claimed over 100 victims. The ransomware attack...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 08.11. 2026

By infosecbulletin / Sunday , November 8 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Alert

Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction

By infosecbulletin / Saturday , November 7 2026

A major system failure has brought customer-facing banking services to a standstill at 128 shinkin banks across western Japan, leaving...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 06.11. 2026

By infosecbulletin / Friday , November 6 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Cyber Attack
• Hot Topic

Cyber attack causes French bank Credit Mutuel Arkea €100 million missing

By infosecbulletin / Friday , November 6 2026

French lender Credit Mutuel Arkea said on Thursday hackers had stolen around €100 million ($112.61 million) in a cyber heist...

Read More

• Hot Topic

OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours

By infosecbulletin / Thursday , November 5 2026

OpenAI says that an automated system found and confirmed 948 different Linux kernel security issues in one run. These flaws...

Read More

• National

Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw

By infosecbulletin / Thursday , November 5 2026

Apple credits Md Rasel Bhuyan and fellow researcher Musaab Khan for discovering an out-of-bounds write vulnerability affecting multiple Apple operating...

Read More

The affected devices include:

Zyxel ATP and USG FLEX series firewalls in on-premise mode, using ZLD firmware versions 4.32 to 5.38 with remote management or SSL VPN enabled. Devices using Nebula cloud management are not affected.

Initial Release date: 21, November 2024
Updated date: 27, November-2024
Current Date: November 29, 202

Zyxel Europe was reportedly one of the victims.
At least 32 victims worldwide have been reported on Helldown’s data leak site
According to CERT-Bund, five German groups are potential targets

To keep your network safe, Zyxel suggests taking these steps:

Update Firmware: Update your device to the latest firmware..
Disable Remote Access: If updates can’t be applied right away, temporarily turn off remote access to your device until the firmware is patched.
Review Best Practices: Review general cybersecurity guidelines.