Wednesday , December 25 2024
Coding

Warning: Poorly Secured Linux SSH Servers Under Attack for Cryptocurrency Mining

AhnLab’s Security Emergency Response Center (ASEC) studies attacks on poorly secured Linux SSH servers and shares the findings on the ASEC Blog.

Attackers need to find out the IP address and SSH account details before installing malware like DDoS bot and CoinMiner. They scan for servers with the SSH service (port 22) activated to carry out brute force or dictionary attacks to get the login information.

CVE-2024-9474
Sophisticated backdoor found in Palo Alto Networks firewalls: Northwave research

Northwave Cyber Security has found a sophisticated backdoor, LITTLELAMB.WOOLTEA, targeting Palo Alto Networks firewalls. A backdoor was found during a...
Read More
CVE-2024-9474  Sophisticated backdoor found in Palo Alto Networks firewalls: Northwave research

New G-Door Vul Allow Hackers Bypass Microsoft 365 Security With Google Docs

A newly discovered vulnerability called "G-Door" enables malicious actors to bypass Microsoft 365 security by exploiting unmanaged Google Docs accounts....
Read More
New G-Door Vul Allow Hackers Bypass Microsoft 365 Security With Google Docs

CVE-2024-53961
Adobe alerts of critical ColdFusion bug with PoC exploit available

Adobe has issued urgent security updates for ColdFusion versions 2023 and 2021 to fix a critical vulnerability (CVE-2024-53961). This flaw...
Read More
CVE-2024-53961  Adobe alerts of critical ColdFusion bug with PoC exploit available

Splunk targets Bangladeshi market: Investing in local talent

Splunk, a unified security and observability platform turn its focuses on Bangladeshi market. On Monday (23 December) Splunk's local partner...
Read More
Splunk targets Bangladeshi market: Investing in local talent

Critical PHP Zero-Day Vulnerability found in Craft CMS To Gain RCE

A major security flaw in Craft CMS, a popular PHP content management system, has been found, enabling unauthenticated remote code...
Read More
Critical PHP Zero-Day Vulnerability found in Craft CMS To Gain RCE

For US$2.6bn, Mastercard acquires threat intelligence firm Recorded Future

Mastercard has completed its acquisition of Recorded Future, an AI-based threat intelligence provider. Mastercard has acquired the company for $2.65...
Read More
For US$2.6bn, Mastercard acquires threat intelligence firm Recorded Future

Eight New ICS Advisories released by CISA

CISA has released eight advisories on vulnerabilities in Industrial Control Systems (ICS). These vulnerabilities affect essential software and hardware in...
Read More
Eight New ICS Advisories released by CISA

Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI

Bank Rakyat Indonesia (BRI), the largest state bank by assets, has assured customers that their data and funds are secure...
Read More
Authority Denies  Hacker claim ransomware attack on Indonesia’s state bank BRI

London-based company “Builder.ai” reportedly exposed 1.2 TB data

Cybersecurity researcher Jeremiah Fowler reported to Website Planet that he found a non-password-protected 1.2 TB dataset containing over 3 million...
Read More
London-based company “Builder.ai” reportedly exposed 1.2 TB data

(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall

Sophos has fixed three separate security vulnerabilities in Sophos Firewall.  The vulnerabilities CVE-2024-12727, CVE-2024-12728, and CVE-2024-12729 present major risks, such...
Read More
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)  Sophos resolved 3 critical vulnerabilities in Firewall

ALSO READ:

Barracuda fixes new ESG zero-day exploited by hackers

Threat actors gain more cryptocurrency by controlling more CoinMiners. They also have the ability to launch stronger DDoS attacks by controlling more DDoS bots. However, in order to increase the number of CoinMiners and DDoS bots, they need to gather more information or account credentials from their targets.

In addition to DDoS bots and CoinMiners, attackers can also install malware to perform scanning and brute force or dictionary attacks on infected systems, allowing them to take advantage of more vulnerable systems. Attackers can also just install scanners and sell the breached IP and account credentials on the dark web.

Poorly managed SSH servers can become targets for various types of malware, including SSH scanner, DDoS bots, and CoinMiners. This post analyzes cases of attacks involving these malware.

Check Also

Bitcoin ATM

GitLab flaw allow Bitcoin ATM giant “Byte Federal” hacked

TechCrunch reports that Byte Federal, a major Bitcoin ATM operator in the U.S., has experienced …

Leave a Reply

Your email address will not be published. Required fields are marked *