article thumbnail

Pro-Ukraine attackers compromise Docker images to launch DDoS attacks on Russian sites

Security Affairs

Pro-Ukraine hackers, likely linked to Ukraine IT Army , are using Docker images to launch distributed denial-of-service (DDoS) attacks against a dozen websites belonging to government, military, and media. CrowdStrike Intelligence assesses these actors almost certainly compromised the honeypots to support pro-Ukrainian DDoS attacks.

Honeypots 102
article thumbnail

Free Tool: Honey Feed

Security Affairs

Cybersecurity expert Marco Ramilli shared another tool of his arsenal that extracts suspicious IPs from undesired connections, his HoneyPots. In other words: HoneyPots. I run a personal HoneyPot network which stands from years and over time it harvested numerous IP addresses which could be, potentially, malicious (typically scanners).

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Weekly podcast: ICS attacks, Reddit and SIM swap arrests

IT Governance

Hello and welcome to the IT Governance podcast for Friday, 10 August. Cybereason’s researchers recently set up a honeypot environment with a network architecture that replicated that of “typical power substation” and waited. Here are this week’s stories. This asset was then, it seems, listed for sale on the xDedic black market.

article thumbnail

Episode 255: EDM, Meet CDM – Cyber Dance Music with Niels Provos

The Security Ledger

Niels Provos has a storied, two decade career on the forefront of cybersecurity, starting in the late 1990s with his work as a graduate student on phenomena like steganography and honeypots.

article thumbnail

Bad Packets warns of over 14,500 Pulse secure VPN endpoints vulnerable to CVE-2019-11510

Security Affairs

The scanning activity detected by the honeypots of BadPackets was originated from a host in Spain, threat actors aim at gaining access into the private VPN network. ?????????????? “Unauthenticated remote attacker with network access via HTTPS can send a specially crafted URI to perform an arbitrary file reading vulnerability.”

article thumbnail

Australian Govt agency ACSC warns of Emotet and BlueKeep attacks

Security Affairs

The Australian agency also warns of Emotet campaigns that in the last months hit the country posing a significant threat for both organizations and government offices. The popular expert Kevin Beaumont observed some of its EternalPot RDP honeypots crashing after being attacked. They only expose port 3389.

article thumbnail

Threat actors are attempting to exploit recently fixed F5 BIG-IP flaw

Security Affairs

The BIG-IP product is an application delivery controller (ADC), it is used by government agencies and major business, including banks, services providers and IT giants like Facebook, Microsoft and Oracle. The attacks against Warren’s honeypots originated from five different IP addresses.