InfoSecBulletin Cybersecurity for mankind
The Shadowserver Foundation reports that a brute force attack has been active since last month, using nearly 2.8 million IP addresses each day attempting to guess the credentials for a wide range of networking devices.
A brute force attack occurs when attackers repeatedly try different usernames and passwords to access an account or device until they find the right combination. Once they gain access, they can hijack the device or network.
Microsoft 2025 February Patch Tuesday fixes 2 zero-days, 55 flaws
Patch Now
SonicWall firewall vuln allows hackers to hijack VPN sessions
SAP Security Patch February 2025: Multi Vulns Addressed
TRACKING RANSOMWARE
Akira Topped January 2025 as the Most Active Ransomware Threat
FinStealer Malware Targets Indian Bank’s Mobile Users, Stealing Credentials
CVE-2024-52875
Over 12,000 Firewall Vulnerable to 1-Click RCE Exploit
CVE-2025-24200
Apple releases update of zero-day vuln exploited in the Wild
Zimbra Releases Updates for SQL Injection, XSS, and SSRF Vulns
CVE-2025-23369
SAML Bypass Auth on GitHub Enterprise Servers to Login
India to launch new domain name for banks to combat digital fraud
The majority of the 1.1 million participants come from Brazil, followed by Turkey, Russia, Argentina, Morocco, and Mexico with many other as source of origin.
These are security devices like firewalls, VPNs, and gateways that are often connected to the internet for remote access.
The attacks mostly involve compromised MikroTik, Huawei, Cisco, Boa, and ZTE routers and IoT devices, often controlled by large malware botnets.
BleepingComputer reports that the Shadowserver Foundation has confirmed that this activity has been ongoing for some time but has recently intensified significantly.
ShadowServer reported that the attacking IP addresses come from various networks and Autonomous Systems, suggesting they may be part of a botnet or linked to residential proxy networks.
To protect edge devices from brute-force attacks, change the default admin password to a strong, unique one, enable multi-factor authentication (MFA), use an allowlist of trusted IPs, and disable unnecessary web admin interfaces.
U.K. orders Apple to let it spy on users’ encrypted accounts: Report
