SecuriTricks

Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor

A financially-motivated threat actor, UNC6148, is targeting fully patched end-of-life SonicWall SMA 100 series appliances. They are using stolen credentials and OTP seeds from previous intrusions to regain access. The actor has deployed a new persistent backdoor/user-mode rootkit called OVERSTEP, w…

backdoor

rootkit

Published: July 18, 2025

Linked vulnerabilities : CVE-2025-32819 (CVSS 8.8), CVE-2021-20039, CVE-2023-44221, CVE-2021-20035, CVE-2024-38475, CVE-2021-20038

Downloadable IOCs: 4

Gremlin Stealer: New Stealer on Sale in Underground Forum

A new information-stealing malware called Gremlin Stealer, written in C#, has been identified by researchers. Advertised on Telegram since March 2025, it targets a wide range of data including browser information, crypto wallets, FTP and VPN credentials. The malware exfiltrates stolen data to a web…

Published: April 29, 2025

Downloadable IOCs: 2

Navigating Through The Fog

An open directory linked to a Fog ransomware affiliate was discovered, containing tools for reconnaissance, exploitation, lateral movement, and persistence. Initial access was gained through compromised SonicWall VPN credentials, while other tools facilitated credential theft and exploitation of Ac…

Published: April 28, 2025

Linked vulnerabilities : CVE-2021-42287, CVE-2021-42278, CVE-2020-1472

Downloadable IOCs: 1

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Black Basta, a ransomware-as-a-service group, has been using an automated brute forcing framework called BRUTED to target edge network devices since 2023. The framework performs internet scanning and credential stuffing against firewalls and VPN solutions in corporate networks. Black Basta prioriti…

Published: April 16, 2025

Downloadable IOCs: 18

Ransomware Initial Access Brokers Exposed

An investigation into a brute force attack on an exposed Remote Desktop server led to the discovery of a larger ransomware ecosystem, particularly initial access brokers. The attack began with domain enumeration and successful compromise of an account from multiple IP addresses. The threat actor's …

ransomware

credential harvesting

initial access brokers

2025-04-11

hive

domain enumeration

Published: April 11, 2025

Downloadable IOCs: 0

Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)

A critical security vulnerability, CVE-2025-22457, affecting Ivanti Connect Secure VPN appliances has been actively exploited since mid-March 2025. The vulnerability allows remote code execution through a buffer overflow. Two new malware families, TRAILBLAZE and BRUSHFIRE, have been deployed along …

espionage

zero-day

vpn

remote code execution

ivanti connect secure

spawnwave

Published: April 4, 2025

Downloadable IOCs: 0

Affiliate Fraud at Scale: AI, Black Hat SEO, Social Media, and Brand Abuse in iGaming and VPNs

A large-scale affiliate marketing campaign has been uncovered, utilizing AI-generated content, automation, fake social media accounts, and Black Hat SEO to manipulate search rankings and drive traffic to iGaming and VPN promotions. The operation involves thousands of subdomains, redirection chains,…

black hat seo

vpn

ai-generated content

social media manipulation

Published: March 13, 2025

Downloadable IOCs: 14

Astrill VPN and DPRK Remote Worker Fraud

Spur Engineering is releasing a comprehensive list of IP addresses associated with the Astrill VPN service to help companies protect against fraud and abuse from the Democratic Republic of Korea (DPRK) in the future.

Published: March 5, 2025

Downloadable IOCs: 2360

Supply chain of Korean VPN service compromised

ESET researchers have uncovered a supply-chain attack against a South Korean VPN provider by a previously unknown China-aligned APT group named PlushDaemon. The attackers replaced the legitimate VPN installer with a malicious version that deployed their SlowStepper backdoor, a feature-rich implant …

Published: January 22, 2025

Downloadable IOCs: 0

Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation

A new zero-day vulnerability, CVE-2025-0282, in Ivanti Connect Secure VPN appliances has been exploited since mid-December 2024. The vulnerability allows unauthenticated remote code execution. Attackers have deployed multiple malware families, including SPAWN, DRYHOOK, and PHASEJAM, to maintain per…

Published: January 9, 2025

Linked vulnerabilities : CVE-2025-0282 (CVSS 9.0), CVE-2025-0283 (CVSS 7.0), CVE-2024-21887, CVE-2023-46805

Downloadable IOCs: 7

Chinese hackers exploit Fortinet VPN zero-day to steal credentials

Chinese threat actors, known as BrazenBamboo, are exploiting a zero-day vulnerability in Fortinet's FortiClient Windows VPN client to steal credentials. The hackers use a custom post-exploitation toolkit called DeepData, which includes a FortiClient plugin to extract usernames, passwords, and VPN s…

Published: November 18, 2024

Downloadable IOCs: 0

November 18 Advisory: Active Exploitation of Critical RCE in Palo Alto Networks PAN-OS [CVE-2024-0012 and CVE-2024-9474]

Two critical vulnerabilities in Palo Alto Networks PAN-OS, CVE-2024-0012 and CVE-2024-9474, have been disclosed. CVE-2024-0012 is an authentication bypass allowing unauthenticated remote attackers to gain admin privileges, while CVE-2024-9474 is an authenticated privilege escalation bug. These can …

authentication bypass

pan-os

critical vulnerability

Published: November 18, 2024

Downloadable IOCs: 0

Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012

A critical authentication bypass vulnerability (CVE-2024-0012) in Palo Alto Networks PAN-OS software allows unauthenticated attackers to gain administrator privileges on affected devices. The issue affects PAN-OS versions 10.2, 11.0, 11.1, and 11.2, but not Cloud NGFW or Prisma Access. Limited expl…

authentication bypass

pan-os

Published: November 18, 2024

Downloadable IOCs: 0

Weaponizing FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA

A Chinese state-affiliated threat actor, BrazenBamboo, has exploited a zero-day vulnerability in Fortinet's Windows VPN client to steal user credentials. The vulnerability allows extraction of login information from the FortiClient process memory. BrazenBamboo uses two malware families: DEEPDATA, a…

Published: November 16, 2024

Downloadable IOCs: 0

Increased Fog and Akira Ransomware Activity Linked to SonicWall SSL VPN

Since early August, there has been a significant increase in Fog and Akira ransomware intrusions targeting SonicWall SSL VPN users across various industries. The attacks appear opportunistic rather than targeting specific sectors. All affected devices lacked patches for CVE-2024-40766. Initial acce…

Published: October 24, 2024

Linked vulnerabilities : CVE-2024-40766 (CVSS 9.8)

Downloadable IOCs: 16

Fog Ransomware – Technical Analysis

A new ransomware called Fog has been identified, affecting education and recreation centers in the United States. The threat actors gain access through compromised VPN credentials, disable Windows Defender, and deploy the ransomware. Fog is a 32-bit EXE file compiled using Microsoft Visual C/C++. I…

Published: October 21, 2024

Downloadable IOCs: 1

Patch or Peril: A Veeam vulnerability incident

While the vulnerability CVE-2023-27532 was made public in March 2023 and subsequently patched by Veeam for versions 12/11a and later for Veeam Backup & Replication software, Group-IB’s Digital Forensics and Incident Response (DFIR) team recently observed a notable incident related to this vulnerabi…

Published: July 12, 2024

Downloadable IOCs: 2

Analysis of Attack Case Installing VPN on Korean ERP Server

This analysis examines an attack where a threat actor compromised a Korean company's ERP server, initially accessing it through a poorly secured MS-SQL service. The actor installed a web shell, stole credentials, and ultimately set up SoftEther VPN on the server, likely to use it as part of a comma…

Published: June 17, 2024

Downloadable IOCs: 11

Tag: vpn

Attack reports

MuddyWater Leveraging DCHSpy For Israel-Iran Conflict

Behind the Curtain: How Lumma Affiliates Operate

Legitimate Chrome VPN Extension Turns to Browser Spyware

Observed Malicious Driver Use Associated with Akira SonicWall Campaign

Active Exploitation of SonicWall VPNs

Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor

Gremlin Stealer: New Stealer on Sale in Underground Forum

Navigating Through The Fog

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Ransomware Initial Access Brokers Exposed

Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)

Affiliate Fraud at Scale: AI, Black Hat SEO, Social Media, and Brand Abuse in iGaming and VPNs

Astrill VPN and DPRK Remote Worker Fraud

Supply chain of Korean VPN service compromised

Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation

Chinese hackers exploit Fortinet VPN zero-day to steal credentials

November 18 Advisory: Active Exploitation of Critical RCE in Palo Alto Networks PAN-OS [CVE-2024-0012 and CVE-2024-9474]

Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012

Weaponizing FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA

Increased Fog and Akira Ransomware Activity Linked to SonicWall SSL VPN

Fog Ransomware – Technical Analysis

Patch or Peril: A Veeam vulnerability incident

Analysis of Attack Case Installing VPN on Korean ERP Server