Check Point released hotfixes for a VPN zero-day vulnerability, tracked as CVE-2024-24919, which is actively exploited in attacks in the wild.

Check Point released hotfixes to address a VPN zero-day vulnerability, tracked as CVE-2024-24919, which is actively being exploited in attacks in the wild.

The vulnerability CVE-2024-24919 is a Quantum Gateway information disclosure issue. Threat actors exploited the flaw to gain remote firewall access and breach corporate networks.

The issue impacts CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Spark Appliances. Impacted versions are R80.20.x, R80.20SP (EOL), R80.40 (EOL), R81, R81.10, R81.10.x, and R81.20.

Early this week, the security firm warned of a surge in attacks aimed at VPN solutions.

“We have recently witnessed compromised VPN solutions, including various cyber security vendors. In light of these events, we have been monitoring attempts to gain unauthorized access to VPNs of Check Point’s customers. By May 24, 2024 we identified a small number of login attempts using old VPN local-accounts relying on unrecommended password-only authentication method,” the company said.

“We have recently witnessed compromised VPN solutions, including various cyber security vendors. In light of these events, we have been monitoring attempts to gain unauthorized access to VPNs of Check Point’s customers.” reads the initial advisory published by the vendor.

“By May 24, 2024 we identified a small number of login attempts using old VPN local-accounts relying on unrecommended password-only authentication method.”

The company started investigating the attacks by assembling special teams of Incident Response, Research, Technical Services and Products professionals. The experts found within 24 hours a few potential customers which were attacked.

On May 28, the experts discovered how attackers were targeing its customers and released a fix for Check Point Network Security gateways.

“The vulnerability potentially allows an attacker to read certain information on Internet-connected Gateways with remote access VPN or mobile access enabled. The attempts we’ve seen so far, as previously alerted on May 27, focus on remote access scenarios with old local accounts with unrecommended password-only authentication.” reads an update to the initial advisory. “Within a few hours of this development, Check Point released an easy to implement solution that prevents attempts to exploit this vulnerability. To stay secure, customers should follow these simple instructions to deploy the provided solution.”

The company also released hotfixes that address the flaw in end-of-life (EOL) versions.

Check Point set up FAQ page to provide information about CVE-2024-24919, such as what customers should do if they suspect unauthorized access attempts.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Check Point VPN zero-day)

The U.S. Department of Justice (DOJ) today said they arrested the alleged operator of 911 S5, a ten-year-old online anonymity service that was powered by what the director of the FBI called “likely the world’s largest botnet ever.” The arrest coincided with the seizure of the 911 S5 website and supporting infrastructure, which the government says turned computers running various “free VPN” products into Internet traffic relays that facilitated billions of dollars in online fraud and cybercrime.

On May 24, authorities in Singapore arrested the alleged creator and operator of 911 S5, a 35-year-old Chinese national named YunHe Wang. In a statement on his arrest today, the DOJ said 911 S5 enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs.

For example, the government estimates that 560,000 fraudulent unemployment insurance claims originated from compromised Internet addresses, resulting in a confirmed fraudulent loss exceeding $5.9 billion.

“Additionally, in evaluating suspected fraud loss to the Economic Injury Disaster Loan (EIDL) program, the United States estimates that more than 47,000 EIDL applications originated from IP addresses compromised by 911 S5,” the DOJ wrote. “Millions of dollars more were similarly identified by financial institutions in the United States as loss originating from IP addresses compromised by 911 S5.”

From 2015 to July 2022, 911 S5 sold access to hundreds of thousands of Microsoft Windows computers daily, as “proxies” that allowed customers to route their Internet traffic through PCs in virtually any country or city around the globe — but predominantly in the United States.

911 S5 built its proxy network mainly by offering “free” virtual private networking (VPN) services. 911’s VPN performed largely as advertised for the user — allowing them to surf the web anonymously — but it also quietly turned the user’s computer into a traffic relay for paying 911 S5 customers.

911 S5’s reliability and extremely low prices quickly made it one of the most popular services among denizens of the cybercrime underground, and the service became almost shorthand for connecting to that “last mile” of cybercrime. Namely, the ability to route one’s malicious traffic through a computer that is geographically close to the consumer whose stolen credit card is about to be used, or whose bank account is about to be emptied.

KrebsOnSecurity first identified Mr. Wang as the proprietor of the popular service in a deep dive on 911 S5 published in July 2022. That story showed that 911 S5 had a history of paying people to install its software by secretly bundling it with other software — including fake security updates for common programs like Flash Player, and “cracked” or pirated commercial software distributed on file-sharing networks.

Ten days later, 911 S5 closed up shop, claiming it had been hacked. But experts soon tracked the reemergence of the proxy network by another name: Cloud Router.

The announcement of Wang’s arrest came less than 24 hours after the U.S. Department of the Treasury sanctioned Wang and two associates, as well as several companies the men allegedly used to launder the nearly $100 million in proceeds from 911 S5 and Cloud Router customers.

Cloud Router’s homepage now features a notice saying the domain has been seized by the U.S. government. In addition, the DOJ says it worked with authorities in Singapore, Thailand and Germany to search residences tied to the defendant, and seized approximately $30 million in assets.

Those assets included a 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, a Rolls Royce, more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, several luxury wristwatches, and 21 residential or investment properties.

The government says Wang is charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. If convicted on all counts, he faces a maximum penalty of 65 years in prison.

Brett Leatherman, deputy assistant director of the FBI’s Cyber Division, said the DOJ is working with the Singaporean government on extraditing Wang to face charges in the United States.

Leatherman encouraged Internet users to visit a new FBI webpage that can help people determine whether their computers may be part of the 911 S5 botnet, which the government says spanned more than 19 million individual computers in at least 190 countries.

Leatherman said 911 S5 and Cloud Router used several “free VPN” brands to lure consumers into installing the proxy service, including MaskVPN, DewVPN, PaladinVPN, Proxygate, Shield VPN, and ShineVPN.

“American citizens who didn’t know that their IP space was being utilized to attack US businesses or defraud the U.S. government, they were unaware,” Leatherman said. “But these kind of operations breed that awareness.”

Cybersecurity researchers have warned of a new malicious Python package that has been discovered in the Python Package Index (PyPI) repository to facilitate cryptocurrency theft as part of a broader campaign. The package in question is pytoileur, which has been downloaded 316 times as of writing. Interestingly, the package author, who goes by the name PhilipsPY, has uploaded a new version of the

Check Point is warning of a zero-day vulnerability in its Network Security gateway products that threat actors have exploited in the wild. Tracked as CVE-2024-24919, the issue impacts CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark appliances. "The vulnerability potentially allows an attacker to read certain information on

Brazilian banking institutions are the target of a new campaign that distributes a custom variant of the Windows-based AllaKore remote access trojan (RAT) called AllaSenha. The malware is "specifically aimed at stealing credentials that are required to access Brazilian bank accounts, [and] leverages Azure cloud as command-and-control (C2) infrastructure," French cybersecurity company HarfangLab

The cybercrime forum BreachForums has been resurrected two weeks after a law enforcement operation that seized its infrastructure.

The cybercrime forum BreachForums is online again, recently a US law enforcement operation seized its infrastructure and took down the platform.

#BREAKINGRegistration to BreachForums is now open.. however be extremely cautious!#DarkWeb #Cybersecurity #Cyberattack #Cybercrime #Malware #Privacy #Infosec pic.twitter.com/NKUsGeEGmk

— Dark Web Informer (@DarkWebInformer) May 28, 2024

The platform is now reachable at breachforums[.]st, which was one of the domains used in the past by the cybercrime forum.

The admin, who is using the moniker ShinyHunters, announced the return:

It is unclear if the current administrator is the notorious ShinyHunters hacker who operated from the platform before the law enforcement operation.

Yay. #breachforums pic.twitter.com/Osiv8CA3MI

— Brett Callow (@BrettCallow) May 27, 2024

ShinyHunters claimed the hack of Ticketmaster and offered for sale 1.3 TB of data, including full details of 560 million customers, for $500,000. Stolen data includes names, emails, addresses, phone numbers, ticket sales, and order details.

CyberKnown researchers speculate the Ticketmaster data breach claim has provided BreachForums with the quick attention they need to boost their user numbers and reputation.

Thoughts on the alleged Ticketmaster Data Breach

TLDR: Alert not Alarmed

The Ticketmaster data breach claim has provided BreachForums with the quick attention they need to boost their user numbers and reputation.

The claim has possibly been over-stated to boost… pic.twitter.com/WJsFkBfQbw

— CyberKnow (@Cyberknow20) May 29, 2024

Hackread.com reported that ShinyHunters regained control of domains despite the FBI’s efforts, exposing notable operational setbacks and security lapses. However, we cannot exclude that the site is a honeypot set up by the feds.

From June 2023 until May 2024, BreachForums (hosted at breachforums.st/.cx/.is/.vc) was run by the notorious actor ShinyHunters.

From March 2022 until March 2023, a separate version of BreachForums (hosted at breached.vc/.to/.co) was run by the threat actor Pompompurin. In July 2023, the owner of the BreachForums Conor Brian Fitzpatrick, aka Pompompurin, pleaded guilty to hacking charges.

In March 2023, U.S. law enforcement arrested Pompompurin, the agents spent hours inside and outside the suspect’s home and were seen removing several bags of evidence from the house.

The man has been charged with soliciting individuals with the purpose of selling unauthorized access devices. Fitzpatrick was released on a $300,000 bond signed by his parents.

The BreachForums hacking forum was launched in 2022 after the law enforcement authorities seized RaidForums as a result of Operation TOURNIQUET. pompompurin always declared that he was ‘not affiliated with RaidForums in any capacity,’

Raidforums (hosted at raidforums.com and run by Omnipotent) was the predecessor hacking forum to both version of BreachForums and ran from early 2015 until February 2022.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

(SecurityAffairs – hacking, malware)

The U.S. Department of Justice (DoJ) has sentenced a 31-year-old man to 10 years in prison for laundering more than $4.5 million through business email compromise (BEC) schemes and romance scams. Malachi Mullings, 31, of Sandy Springs, Georgia pleaded guilty to the money laundering offenses in January 2023. According to court documents, Mullings is said to have opened 20 bank accounts in the

A recent study by Wing Security found that 63% of businesses may have former employees with access to organizational data, and that automating SaaS Security can help mitigate offboarding risks.  Employee offboarding is typically seen as a routine administrative task, but it can pose substantial security risks, if not handled correctly. Failing to quickly and thoroughly remove access for

A never-before-seen North Korean threat actor codenamed Moonstone Sleet has been attributed as behind cyber attacks targeting individuals and organizations in the software and information technology, education, and defense industrial base sectors with ransomware and bespoke malware previously associated with the infamous Lazarus Group. "Moonstone Sleet is observed to set up fake companies and

Dutch bank ABN Amro discloses data breach following a ransomware attack hit the third-party services provider AddComm.

Dutch bank ABN Amro disclosed a data breach after third-party services provider AddComm suffered a ransomware attack. AddComm distributes documents and tokens physically and digitally to clients and employees.

The ransomware attack occurred last week and unauthorized parties may have obtained access to data of a limited number of ABN AMRO clients. ABN AMRO is going to contact the impacted clients and notified the Dutch Data Protection Authority and regulators.

At the time of this writing, AddComm has contained the incident, the impacted systems have been restored, and the company has locked out the attackers. AddComm has yet to determine what type of data may have been stolen during the attack. However, the company is investigating the incident with the help of external security experts working for AddComm.

The Dutch bank has stopped using services provided by AddComm.

At the moment, there are no indications that attackers have used the data of ABN AMRO clients. The bank also warns clients to stay alert to phishing messages.

The bank added that its systems have not been affected by the ransomware attack.

“External cybersecurity experts are currently investigating exactly what data has been stolen at AddComm. We are writing to customers whose data may be involved in this attack.” states the bank.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)

The online criminal bazaar BreachForums has been resurrected merely two weeks after a U.S.-led coordinated law enforcement action dismantled and seized control of its infrastructure. Cybersecurity researchers and dark web trackers Brett Callow, Dark Web Informer, and FalconFeeds revealed the site's online return at breachforums[.]st – one of the dismantled sites – by a user named ShinyHunters,

Auction house Christie disclosed a data breach following a RansomHub cyber attack that occurred this month.

Auction house Christie’s disclosed a data breach after the ransomware group RansomHub threatened to leak stolen data. The security breach occurred earlier this month.

The website of the auction house was unreachable after the attack.

According to BBC, Christie had problems in selling art and other high-value items worth an estimated $840 million due to a cyberattack. The spring auctions include a Vincent van Gogh painting valued at $35 million and rare wine, among other lots.

Some sales have been delayed due to the cyber attack.

RansomHub claimed responsibility for the attack and added the company to its Tor leak site. The extortion group said they had stolen 2GB of sensitive information, including personal information belonging to at least 500,000 Christie’s clients.

“While utilizing access to Christies network we were able to gain access to their customers sensitive personal information including [BirthPlace MRZFull DocumentNumber BirthDate ExpiryDate FirstName LastName IssueDate IssuingAuthority Sex DocumentCategory DocumentType NationalityName] as well as address, hieght, race and much more sensitive information for at least 500,000 of their private clients from all over the world.” states the group.

The group is threatening to leak the stolen data if the victim will not pay the ransom by Sunday, June 2,024.

The gang said it has attempted to negotiate the payment with the auction house without success. The gang added that after they will post stolen data, Christie will incur heavy fines from GDPR.

“Earlier this month Christie’s experienced a technology security incident. We took swift action to protect our systems, including taking our website offline” “Our investigations determined there was unauthorized access by a third party to parts of Christie’s network.” a company spokesman told BleepingComputer. “They also determined that the group behind the incident took some limited amount of personal data relating to some of our clients.”

The auction house is notifying privacy regulators and law enforcement, it is also going to inform impacted clients.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)

The U.S. Department of the Treasury today unveiled sanctions against three Chinese nationals for allegedly operating 911 S5, an online anonymity service that for many years was the easiest and cheapest way to route one’s Web traffic through malware-infected computers around the globe. KrebsOnSecurity identified one of the three men in a July 2022 investigation into 911 S5, which was massively hacked and then closed ten days later.

From 2015 to July 2022, 911 S5 sold access to hundreds of thousands of Microsoft Windows computers daily, as “proxies” that allowed customers to route their Internet traffic through PCs in virtually any country or city around the globe — but predominantly in the United States.

911 built its proxy network mainly by offering “free” virtual private networking (VPN) services. 911’s VPN performed largely as advertised for the user — allowing them to surf the web anonymously — but it also quietly turned the user’s computer into a traffic relay for paying 911 S5 customers.

911 S5’s reliability and extremely low prices quickly made it one of the most popular services among denizens of the cybercrime underground, and the service became almost shorthand for connecting to that “last mile” of cybercrime. Namely, the ability to route one’s malicious traffic through a computer that is geographically close to the consumer whose stolen credit card is about to be used, or whose bank account is about to be emptied.

In July 2022, KrebsOnSecurity published a deep dive into 911 S5, which found the people operating this business had a history of encouraging the installation of their proxy malware by any means available. That included paying affiliates to distribute their proxy software by secretly bundling it with other software.

That story named Yunhe Wang from Beijing as the apparent owner or manager of the 911 S5 proxy service. In today’s Treasury action, Mr. Wang was named as the primary administrator of the botnet that powered 911 S5.

“A review of records from network infrastructure service providers known to be utilized by 911 S5 and two Virtual Private Networks (VPNs) specific to the botnet operation (MaskVPN and DewVPN) showed Yunhe Wang as the registered subscriber to those providers’ services,” reads the Treasury announcement.

Update, May 29, 12:26 p.m. ET: The U.S. Department of Justice (DOJ) just announced they have arrested Wang in connection with the 911 S5 botnet. The DOJ says 911 S5 customers have stolen billions of dollars from financial institutions, credit card issuers, and federal lending programs.

“911 S5 customers allegedly targeted certain pandemic relief programs,” a DOJ statement on the arrest reads. “For example, the United States estimates that 560,000 fraudulent unemployment insurance claims originated from compromised IP addresses, resulting in a confirmed fraudulent loss exceeding $5.9 billion. Additionally, in evaluating suspected fraud loss to the Economic Injury Disaster Loan (EIDL) program, the United States estimates that more than 47,000 EIDL applications originated from IP addresses compromised by 911 S5. Millions of dollars more were similarly identified by financial institutions in the United States as loss originating from IP addresses compromised by 911 S5.”

The sanctions say Jingping Liu was Yunhe Wang’s co-conspirator in the laundering of criminally derived proceeds generated from 911 S5, mainly virtual currency. The government alleges the virtual currencies paid by 911 S5 users were converted into U.S. dollars using over-the-counter vendors who wired and deposited funds into bank accounts held by Liu.

“Jingping Liu assisted Yunhe Wang by laundering criminally derived proceeds through bank accounts held in her name that were then utilized to purchase luxury real estate properties for Yunhe Wang,” the document continues. “These individuals leveraged their malicious botnet technology to compromise personal devices, enabling cybercriminals to fraudulently secure economic assistance intended for those in need and to terrorize our citizens with bomb threats.”

The third man sanctioned is Yanni Zheng, a Chinese national the U.S. Treasury says acted as an attorney for Wang and his firm — Spicy Code Company Limited — and helped to launder proceeds from the business into real estate holdings. Spicy Code Company was also sanctioned, as well as Wang-controlled properties Tulip Biz Pattaya Group Company Limited, and Lily Suites Company Limited.

Ten days after the July 2022 story here on 911 S5, the proxy network abruptly closed up shop, citing a data breach that destroyed key components of its business operations.

In the months that followed, however, 911 S5 would resurrect itself under a different name: Cloud Router. That’s according to spur.us, a U.S.-based startup that tracks proxy and VPN services. In February 2024, Spur published research showing the Cloud Router operators reused many of the same components from 911 S5, making it relatively simple to draw a connection between the two.

Spur found that Cloud Router was being powered by a new VPN service called PaladinVPN, which made it much more explicit to users that their Internet connections were going to be used to relay traffic for others. At the time, Spur found Cloud Router had more than 140,000 Internet addresses for rent.

Spur co-founder Riley Kilmer said Cloud Router appears to have suspended or ceased operations sometime this past weekend. Kilmer said the number of proxies advertised by the service had been trending downwards quite recently before the website suddenly went offline.

Cloud Router’s homepage is currently populated by a message from Cloudflare saying the site’s domain name servers are pointing to a “prohibited IP.”

Researchers released a proof-of-concept (PoC) exploit for remote code execution flaw CVE-2024-23108 in Fortinet SIEM solution.

Security researchers at Horizon3’s Attack Team released a proof-of-concept (PoC) exploit for a remote code execution issue, tracked as CVE-2024-23108, in Fortinet’s SIEM solution. The PoC exploit allows executing commands as root on Internet-facing FortiSIEM appliances.

In February, cybersecurity vendor Fortinet warned of two critical vulnerabilities in FortiSIEM, tracked as CVE-2024-23108 and CVE-2024-23109 (CVSS score 10), which could lead to remote code execution.

“Multiple improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiSIEM supervisor may allow a remote unauthenticated attacker to execute unauthorized commands via crafted API requests.” reads the advisory published by Fortinet.

The affected products are:

• FortiSIEM version 7.1.0 through 7.1.1
• FortiSIEM version 7.0.0 through 7.0.2
• FortiSIEM version 6.7.0 through 6.7.8
• FortiSIEM version 6.6.0 through 6.6.3
• FortiSIEM version 6.5.0 through 6.5.2
• FortiSIEM version 6.4.0 through 6.4.2

The CERT-EU also published an advisory for the above vulnerabilities:

“In February 2024, Fortinet quietly updated a 2023 advisory, joining two critical flows to the list of OS Command vulnerabilities affecting its FortiSIEM product. If exploited, these vulnerabilities could allow a remote unauthenticated attacker to execute commands on the system.” reads the advisory published by CERT-EU. “Updating is recommended as soon as possible.”

This week, Horizon3’s Attack Team also published a technical analysis of the vulnerability.

“While the patches for the original PSIRT issue, FG-IR-23-130, attempted to escape user-controlled inputs at this layer by adding the wrapShellToken() utility, there exists a second order command injection when certain parameters to datastore.py are sent. There” reads the analysis.

The researchers noticed that the logs for the phMonitor service, located at /opt/phoenix/logs/phoenix.log, provide detailed records of received messages. Any exploitation attempt of CVE-2024-23108 will generate log entries indicating a failed command with “datastore.py nfs test.” These lines should be used as indicators of compromise to detect exploitation attempts.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SIEM)

An Indian national has pleaded guilty in the U.S. over charges of stealing more than $37 million by setting up a website that impersonated the Coinbase cryptocurrency exchange platform. Chirag Tomar, 30, pleaded guilty to wire fraud conspiracy, which carries a maximum sentence of 20 years in prison and a $250,000 fine. He was arrested on December 20, 2023, upon entering the country. "Tomar and

You’re probably familiar with the term “critical assets”. These are the technology assets within your company's IT infrastructure that are essential to the functioning of your organization. If anything happens to these assets, such as application servers, databases, or privileged identities, the ramifications to your security posture can be severe.  But is every technology asset considered

The threat actors behind the CatDDoS malware botnet have exploited over 80 known security flaws in various software over the past three months to infiltrate vulnerable devices and co-opt them into a botnet for conducting distributed denial-of-service (DDoS) attacks. "CatDDoS-related gangs' samples have used a large number of known vulnerabilities to deliver samples," the QiAnXin XLab team 

Threat actors are exploiting a WordPress plugin to insert malicious PHP code in e-commerce sites and steal credit card data.

Sucuri researchers observed threat actors using a PHP snippet WordPress plugin to install malicious code in WooCommerce e-stores and harvest credit card details.

In the campaign spotted by the experts, attackers use a very obscure WordPress plugin called Dessky Snippets, which has only a few hundred active installations at the time of writing.

Dessky Snippets is a lightweight and simple plugin that gives users the ability to easily add custom PHP code from WordPress admin.

The campaign occurred on May 11th, and the researchers observed a surge in downloads of the Dessky Snippets plugin from that same day. At this time, the WordPress plugin has over 200 active installations.

Attackers exploited the Dessky Snippets plugin to insert a server-side PHP credit card e-skimmer.

“This malicious code was saved in the dnsp_settings option in the WordPress wp_options table and was designed to modify the checkout process in WooCommerce by manipulating the billing form and injecting its own code.” reads the analysis published by Sucuri.

The malware has two main components. The first part uses a fake function named “twentytwenty_get_post_logos()” to hook into WooCommerce’s billing form. The function adds additional fields to the billing form to request credit card details earlier than usual. The second part involves an obfuscated credit card skimmer that monitors POST data for specific parameters. When the malware detects these parameters, it sends all the collected billing and credit card information to a third-party URL “hxxps://2of[.]cc/wp-content/”.

The researchers noticed that the billing form associated with the overlay used by the attackers has the autocomplete feature disabled, The fields are set with autocomplete=”off”.

Disabling the auto-fill feature on the fake checkout form is an evasion trick that reduces the chances of the browser warning users about entering sensitive information. The fields remain blank until manually filled out, making them look like regular, necessary inputs for the transaction and reducing user suspicion.

“In essence, ecommerce sites are prime targets for hackers due to the valuable data they handle.” concludes the report. “Here’s a simple guide to protect your online store:

1. Keep your software patched: Regularly update your CMS, plugins, themes, and any third-party components to patch vulnerabilities.
2. Use strong passwords: Ensure all accounts, including admin, sFTP, and database credentials, have strong and unique passwords.
3. Select trusted scripts: Only integrate third-party JavaScript from reputable sources. Avoid unnecessary third-party scripts.
4. Monitor for threats: Regularly check your site for signs of malware, unauthorized changes, or any indicators of compromise.
5. Implement a firewall: Use a web application firewall to block malicious bots, virtually patch known vulnerabilities, and filter harmful traffic.
6. Set up a CSP: Establish a Content Security Policy (CSP) to protect against clickjacking, cross-site scripting (XSS), and other threats.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, WordPress)

Researchers warn of a critical remote code execution vulnerability in TP-Link Archer C5400X gaming router.

Researchers at OneKey discovered a a critical remote code execution (RCE) vulnerability, tracked as CVE-2024-5035 (CVSS score 10.0), in TP-Link Archer C5400X gaming router.

A remote, unauthenticated, attacker can exploit the vulnerability to execute commands on the device.

The TP-Link Archer C5400X is a high-performance gaming router designed for demanding applications such as online gaming and streaming.

The vulnerability resides in a binary called “rftest” that is executed during device startup. The researchers discovered that the binary exposes a network service that is susceptible to unauthenticated command injection and buffer overflows on TCP ports 8888, 8889, and 8890

“By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated privileges.” reads the report published by the OneKey. “It’s unclear whether the binary is always launched and whether it is always exposed on LAN/WAN interfaces. We reproduced the issue within an emulator, but production device may behave differently. We put our trust in TP-Link in assessing the actual exposure of this vulnerability.“

The experts noticed that upon executing the binary, it starts a TCP server on port 8888, accepting commands from clients. The binary only accepts commands starting with “wl” or “nvram get”. However, this limitation can be bypassed for command injection by appending shell meta-characters like “;”, “&”, or “|”.

TP-Link addressed the issue by discarding any command containing shell meta-characters.

The issue affects firmware versions, through 1.1.1.6, Archer C5400X(EU)_V1_1.1.7 Build 20240510 addressed the flaw.

Below is the timeline for this flaw:

• 2024-02-16 –Report submitted to TP-Link PSIRT through encrypted email.
• 2024-02-19 –Case opened by TP-Link PSIRT.
• 2024-04-10 –TP-Link shares a beta version of 1.1.7p1 for validation.
• 2024-04-17 –Patch confirmed by ONEKEY.
• 2024-05-27 –Release ONEKEY advisory in coordination with TP-Link

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, TP-Link Archer C5400X)

Unknown threat actors are abusing lesser-known code snippet plugins for WordPress to insert malicious PHP code in victim sites that are capable of harvesting credit card data. The campaign, observed by Sucuri on May 11, 2024, entails the abuse of a WordPress plugin called Dessky Snippets, which allows users to add custom PHP code. It has over 200 active installations.

A maximum-severity security flaw has been disclosed in the TP-Link Archer C5400X gaming router that could lead to remote code execution on susceptible devices by sending specially crafted requests. The vulnerability, tracked as CVE-2024-5035, carries a CVSS score of 10.0. It impacts all versions of the router firmware including and prior to 1_1.1.6. It has&nbsp

Prescription service firm Sav-Rx disclosed a data breach that potentially impacted over 2.8 million people in the United States.

Prescription service company Sav-Rx disclosed a data breach after 2023 cyberattack. The company is notifying 2,812,336 individuals impacted by the security breach in the United States.

A&A Services, which operates as Sav-RX, shared with the Maine Attorney General’s office the data breach notification letter sent to the impacted individuals.

The investigation conducted by the company with the help of external cybersecurity experts revealed that threat actors first gained access to the IT System on or around October 3, 2023.

“On October 8, 2023, we identified an interruption to our computer network. As a result, we immediately took steps to secure our systems and engaged third-party cybersecurity experts. Our information technology systems (“IT System”) were restored the next business day, and prescriptions were shipped on time without delay.” reads the letter sent to the impacted individuals. “As part of the investigation, we learned that an unauthorized third party was able to access certain non-clinical systems and obtained files that contained health information. After an extensive review with third-party experts, on April 30, 2024, we discovered that some of the data accessed or acquired by the unauthorized third party may have contained your protected health information.”

Compromised data includes full name, date of birth, Social Security Number (SSN), email address, physical address, phone number, eligibility data, and insurance identification number.

Sav-Rx took eight months to notify impacted individuals to avoid impacting patient care with its investigation.

“Our initial priority was restoring systems to minimize any interruption to patient care.” states the company. “The incident did not affect our pharmacy systems, including those systems related to our mail order pharmacy. Not all customers were impacted, and not all health plan participants were impacted.”

The company promptly notified law enforcement authorities. Sav-Rx worked with external cybersecurity experts to contain the incident and ensure any data stolen from the company was destroyed and not further disseminated.

The firm pointed out that the incident had a limited impact on its operations, its IT system was restored
the next business day and there was no delay in the shipment of prescriptions.

The prescription service provider also announced it has enhanced its security protocols, controls, technology, and training.

Sav-Rx is offering impacted individuals complimentary access to 24 months of credit monitoring and identity theft restoration services provided by Equifax.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)

Organizations had to re-examine the traditional business perimeter and migrate to cloud-based tools to support distributed workforces. Which is the impact?

The almost overnight shift to remote work, driven by the COVID-19 pandemic, has profoundly impacted how businesses use technology. Organizations across the globe had to adapt and adapt quickly.  They had to re-examine the traditional business perimeter and migrate to cloud-based tools to support distributed workforces.

Cloud-based applications and services can be accessed from anywhere via an internet connection, facilitating seamless collaboration among remote workers. The cloud can be scaled up or down based on demand, providing the flexibility to support varying workloads and user numbers and eliminating the danger of under or over-provisioning.

In addition, by moving to the cloud, companies can reduce the capital expenditure associated with maintaining on-premises infrastructure. Cloud-based tools such as Microsoft Teams, Slack, and Google Workspace also boost collaboration and communication among remote teams, driving productivity and innovation.

Cloud Security Challenges

However, adopting cloud computing significantly expanded the attack surface for businesses, effectively dissolving the traditional network perimeter. This shift introduced new vulnerabilities, and conventional security measures designed to protect a well-defined, centralized perimeter were no longer enough.

Enterprises typically use multiple cloud services from a wide range of vendors for business applications, development environments, and IT infrastructure management. This multi or hybrid cloud strategy can introduce unexpected complexities and challenges, which are exacerbated when different business units and teams adopt cloud solutions without the approval or knowledge of the central IT department.

Storing data in the cloud also comes with a heightened risk of data breaches. These environments house a significant amount of valuable and sensitive information, making them attractive to malicious actors. Moreover, cloud platforms store vast amounts of data in centralized repositories, and this concentration of data creates a single point of failure that, if breached, can lead to major data loss and exposure.

Cloud environments are also highly dynamic, complex, and distributed, which can obscure visibility into assets, data flows, and security postures. Furthermore, many cloud services operate on a multi-tenant model, where multiple customers share the same infrastructure. Although cloud providers implement stringent isolation mechanisms, the shared nature of the infrastructure can introduce vulnerabilities that, if exploited, can affect multiple customers.

In addition to these challenges, cloud security adds a new form of security alert for analysts to triage and investigate, adding to the overall costs. Managing cloud alerts effectively requires overcoming the unique complexities introduced by cloud architectures. The sheer volume of alerts generated by various cloud resources can easily overwhelm security teams. Each cloud service has its own set of security and audit logs, which often provide data in non-standard formats, adding to the complexity of monitoring and analysis.

Furthermore, the lack of clear visibility across different cloud platforms and services can hinder effective response strategies, as security teams struggle to correlate alerts across a fragmented ecosystem. This situation demands robust automation and integration of security tools to ensure comprehensive coverage and swift response to potential threats in cloud environments.

Compliance Across Jurisdictions

Compliance is another challenge. Ensuring compliance with industry regulations and standards in a cloud environment can be complex. Different industries and regions have specific regulatory requirements, such as the General Data Protection Regulation (GDPR) for data protection in the EU, the Health Insurance Portability and Accountability Act (HIPAA) for healthcare information in the US, and the Payment Card Industry Data Security Standard (PCI-DSS) for credit card information. These regulations have unique requirements for data handling, security controls, and reporting.

The cloud landscape constantly evolves, with new services, features, and configurations continuously introduced. Maintaining compliance in a dynamic setting requires continuous monitoring and adaptation to ensure that all deployed services comply with regulatory standards.

Misconfigurations Exposing Data

Cloud misconfigurations are another major cause of security vulnerabilities. They often result from human error or a lack of understanding of complex cloud environments. These misconfigurations can expose sensitive data and systems to unauthorized access and breaches.

For example, setting overly permissive access controls can inadvertently expose sensitive data to the public internet or unauthorized users. This could include misconfigured storage buckets, databases, and virtual machines. Also, failure to change default security settings can leave cloud resources vulnerable to exploitation. Default settings often lack adequate security and should be customized to meet the organization’s specific security requirements.

 Poor network segmentation is another culprit, and once bad actors gain a foothold, it can allow them to move laterally within a cloud environment. Properly segmenting networks can contain potential breaches and limit the spread of attacks.

Understanding Responsibilities

Security in the cloud operates on a shared responsibility model, where the cloud service provider and the customer have distinct security obligations. This model outlines security duties, ensuring that both parties contribute to a secure cloud environment.

Cloud service providers are typically responsible for the security of the cloud infrastructure, including physical security, network infrastructure, and the hypervisor layer. They ensure that the foundational services are secure and reliable. However, customers are responsible for securing their data, managing user access, and configuring security settings for their applications and services that run in the cloud.

Organizations must clearly understand their responsibilities within this model to implement appropriate security measures. This includes data encryption, identity and access management, regular patching, and compliance with relevant regulatory requirements. Failure to understand and act upon these responsibilities can lead to security vulnerabilities and data breaches.

A Proactive Approach

The shift to remote work and the migration to cloud-based solutions have transformed the traditional security perimeter. While these trends offer numerous benefits, they also introduce new challenges and risks.

Traditional security approaches, which rely on static defenses, are insufficient to address the evolving threat landscape in the cloud. The cloud’s dynamic and interconnected nature demands a more automated approach, where the SOC teams enforce security best practices that emphasize efficiency in threat detection using AI-enabled automation tools.

By adopting a proactive approach to security, organizations can successfully navigate this new world and ensure the secure and efficient operation of their distributed workforces. 

About the Author:  Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications. She is also a regular writer at Bora.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, cybersecurity)

Experts warn of a new ATM malware family that is advertised in the cybercrime underground, it was developed to target Europe.

A threat actor is advertising a new ATM malware family that claims to be able of compromised 99% of devices in Europe. The threat actor is offering the malware for $30,000, he claims that the “EU ATM Malware” is designed from scratch and that can also target approximately 60% of ATMs worldwide.

If the claims are true, this malware poses a significant threat to the global banking industry. According to the announcement, the ATM malware can target machines manufactured by multiple leading vendors, including Diebold Nixdorf, Hyosung, Oki, Bank of America, NCR, GRG, and Hitachi.

“The developers of this malware claim that it can generate up to $30,000 per ATM, making it a lucrative tool for cybercriminals.” reported the website DailyDarkweb. “The malware is fully automated, simplifying its deployment and operation.”

The malware is fully automated, making its deployment and operation straightforward and efficient, however, it also supports a manual operation mode.

The seller is offering the malware with multiple payment options, including a monthly subscription and an initial fee plus a share of the profits from successful jackpotting operations.

The threat actors also give customers a test payload option valid for three days.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

Microsoft is calling attention to a Morocco-based cybercrime group dubbed Storm-0539 that's behind gift card fraud and theft through highly sophisticated email and SMS phishing attacks. "Their primary motivation is to steal gift cards and profit by selling them online at a discounted rate," the company said in its latest Cyber Signals report. "We've seen some examples where

The transition to the cloud, poor password hygiene and the evolution in webpage technologies have all enabled the rise in phishing attacks. But despite sincere efforts by security stakeholders to mitigate them - through email protection, firewall rules and employee education - phishing attacks are still a very risky attack vector. A new report by LayerX explores the state of

Cybersecurity researchers are alerting of phishing campaigns that abuse Cloudflare Workers to serve phishing sites that are used to harvest users' credentials associated with Microsoft, Gmail, Yahoo!, and cPanel Webmail. The attack method, called transparent phishing or adversary-in-the-middle (AitM) phishing, "uses Cloudflare Workers to act as a reverse proxy server for a

Cisco addressed a SQL injection vulnerability in the web-based management interface of the Firepower Management Center (FMC) Software. 

Cisco addressed a vulnerability, tracked as CVE-2024-20360 (CVSS score 8.8), in the web-based management interface of the Firepower Management Center (FMC) Software. 

The vulnerability is a SQL injection issue, an attacker can exploit the flaw to obtain any data from the database, execute arbitrary commands on the underlying operating system, and elevate privileges to root. The attacker can exploit this vulnerability only if it has at least Read Only user credentials.

“A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.” reads the advisory. “This vulnerability exists because the web-based management interface does not adequately validate user input. An attacker could exploit this vulnerability by authenticating to the application and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to obtain any data from the database, execute arbitrary commands on the underlying operating system, and elevate privileges to root. To exploit this vulnerability, an attacker would need at least Read Only user credentials.”

Cisco states that there are no workarounds that address this vulnerability. The IT giant has confirmed that this vulnerability does not affect Adaptive Security Appliance (ASA) Software or Firepower Threat Defense (FTD) Software.

The Cisco Product Security Incident Response Team (PSIRT) is not aware attacks in the wild exploiting this vulnerability.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SQL Injection)

The Pakistan-nexus Transparent Tribe actor has been linked to a new set of attacks targeting Indian government, defense, and aerospace sectors using cross-platform malware written in Python, Golang, and Rust. "This cluster of activity spanned from late 2023 to April 2024 and is anticipated to persist," the BlackBerry Research and Intelligence Team said in a technical report