Endpoint/Device Security

Significant stealth capabilities have been exhibited by threat actors behind the Operation Triangulation campaign, which emerged in June and involved the exploitation of Apple iOS zero-day vulnerabilities to facilitate the deployment of the TriangleDB backdoor for data exfiltration, has been discovered to exhibit significant stealth capabilities, The Hacker News reports.

BleepingComputer reports that QNAP has worked with Digital Ocean to dismantle a command-and-control server leveraged to facilitate far-reaching brute-force attacks aimed at vulnerable QNAP network-attached storage devices just two days after identifying the intrusions on Oct. 14.

Tech companies, professional services organizations, and government entities have been subjected to attacks exploiting a critical information disclosure vulnerability in Citrix NetScaler Application Delivery Controller and NetScaler Gateway instances, tracked as CVE-2023-4966, since late August, or about two months prior to the release of a fix, reports The Register.

North Korea's Lazarus Group, also known as TEMP.Hermit or Hidden Cobra, has been continuing its Operation Dream Job campaign with new intrusions leveraging trojanized Virtual Network Computing apps targeted at defense industry and nuclear engineers, according to The Hacker News.

As the number of exposed devices tops 74,000, according to some reports, security pros say short of a patch, the workaround of disabling the HTTP feature in IOS XE is the best bet for now.

More than 40,000 of over 1.8 million administrator credentials compromised by information-stealing malware that have been recovered from January to September were "admin," indicating the prevalence of weak passwords used in administrator portals and the elevated vulnerability of enterprise networks to cyberattacks, reports BleepingComputer.