Using Censys to Track the Murdoc Botnet Campaign Targeting AVTECH Cameras and Huawei Routers
Murdoc Mirai botnet targets AVTECH cameras & Huawei HG532 routers via known CVEs. See live infection data, C2 servers, and steps to secure exposed devices.
Topic
Rapid Response
24 posts
The DigiCert DCV Bug: Implications and Industry Impact
DigiCert's DCV bug impacted 83,267 certificates. Censys research reveals 26,373 still in use, top industries affected, and key takeaways for certificate management.
July 2: Polyfill.io Supply Chain Attack - Digging into the Web of Compromised Domains
Polyfill.io supply chain attack exposes 384K+ hosts to malware. Learn how Censys detected compromised domains, affected sites like Hulu & Mercedes-Benz, and how to protect your website.
June 20: Improper Authentication Vulnerability in ASUS Routers
Critical ASUS router vulnerability CVE-2024-3080 (CVSS 9.8) exposes 157K+ devices to authentication bypass. See affected models, global exposure data, and detection queries from Censys.
June 18, 2024: Heap Overflow Vulnerabilities in VMWare vCenter Server
Critical VMware vCenter Server heap overflow vulnerabilities (CVE-2024-37079, CVE-2024-37080) with CVSS 9.8. Learn patch details, exploitation risks, and Censys detection queries.
The Global Impact of CVE-2024-24919 in CheckPoint VPN Gateways
Discover Censys research on CVE-2024-24919: 13,754 exposed Check Point VPN gateways globally. Get stats on vulnerable devices, patching rates, and risk analysis.
CrushFTP CVE-2024-4040: Crushed Expectations
CrushFTP CVE-2024-4040 zero-day vulnerability: Censys reveals ~5,700 exposed instances. Learn about active exploitation risks, remediation insights, and attack surface findings.
ConnectWise ScreenConnect - CVE-2024-1709 & CVE-2024-1708
Critical ConnectWise ScreenConnect vulnerabilities CVE-2024-1709 & CVE-2024-1708 actively exploited. Learn patch details, exposure data, and how to protect your systems now.
The Mass Exploitation of Ivanti Connect Secure
Censys tracks 26,000+ exposed Ivanti Connect Secure hosts and 412 compromised IPs. Learn about CVE-2023-46805 & CVE-2024-21887 exploitation and mitigations.
Cisco IOS XE: Ten days later
Last week, we shared information about an ongoing event with Cisco devices and a backdoor installed on tens of thousands of Cisco hosts. And in our last update, we noted a significant drop in the number of infections. And would you believe that number has dropped to zero? Well, sort of… Since then, […]
HTTP/Who? CVE-2023-44487
Looking Closer at the Attack Mechanics On October 10, Google and Cloudflare released reports concerning abuse of a specific feature in the HTTP/2 protocol, leading to increased load and a potential denial-of-service on servers that cannot keep up with many concurrent requests. Their reports go into detail about a scenario where an actor […]
MikroTik RouterOS CVE-2023-30799: On the Dangers of Public Admin Interfaces
Continue to track the state of vulnerability with our interactive dashboard Introduction Threat researchers at VulnCheck recently brought renewed attention to a critical remote post-authentication privilege escalation vulnerability in MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6, tracked as CVE-2023-30799. This exploit was first published by researchers from Margin Research at REcon […]
MOVEit: an Industry Analysis
Note: As Censys is an internet scanner, we cannot determine if these devices are vulnerable; these are the MOVEit services we found running exposed on the internet. Introduction Recently, Managed File Transfer (MFT) services have been gaining considerable attention in the realm of security. Although MFT may not be a regular discussion topic, it is […]
Zyxel Vulnerabilities
Zyxel has had an interesting run the last few weeks, with three new vulnerabilities: CVE-2023-33009, CVE-2023-33010, and the most critical, CVE-2023-28771. The Mirai botnet is currently exploiting CVE-2023-28771. Censys found 24,457 potentially vulnerable Zyxel ATP, USG, and VPN products exposed to the internet. 86.72% of these hosts run the IKE protocol required for successful CVE-2023-28771 […]
Months after first GoAnywhere MFT zero-day attacks, Censys still sees ~180 public admin panels
GoAnywhere MFT Breaches by high-profile ransomware groups have now affected 8 confirmed organizations (and counting) Executive Summary: Timeline: The Internet’s Response: We observe a slow and steady patch response to this actively exploited vulnerability. Since this zero-day was first disclosed, Censys has seen an approximate 46% decrease in the number of exposed GoAnywhere Admin Panels […]
Censys in the News: ESXiArgs Ransomware Coverage
The Censys research team has been closely monitoring the spread of ESXiArgs ransomware since it was first detected in early February. The team has used Censys internet scanning data to track infected hosts across countries, to monitor how the hacker group has since responded, and to develop a dashboard with Censys data that researchers […]
RCE Zero Day in GoAnywhere MFT [CVE-2023-0669]
The list of organizations who have come forward as victims of a GoAnywhere breach has grown long: Community Health Systems, Hatch Bank, Hitachi Energy, Rubrik, the City of Toronto, Procter & Gamble, Saks Fifth Avenue, and Crown Resorts. update 2023-03-17 Hitachi Energy has become the 3rd organization to report a data breach in its GoAnywhere […]
Pulse Connect Secure: A View from the Internet
Pulse Connect Secure is a low-cost and widely-deployed SSL VPN solution for remote and mobile users. Over the years, researchers have found several significant vulnerabilities in the server software, some even resulting in the active exploitation of critical infrastructure by malicious threat actors. In April of 2021, CISA released a report detailing some of […]
Critical Vulnerability (CVE-2021-35587) in Oracle Fusion Middleware Now Exploited!
On Monday, November 28, 2022, the Cybersecurity & Infrastructure Security Agency (CISA) added CVE-2021-35587 and CVE-2022-4135 to its Known Exploited Vulnerabilities Catalog and provided an update based on evidence of active exploitation. CVE-2021-35587 is associated with Oracle Fusion Middleware Access Management, which is an enterprise level Single Sign-on (SSO) solution. CVE-2021-35587 allows for Pre-auth Remote Code […]
Critical Vulnerability in OpenSSL!
Quick Links Censys Search Query for OpenSSL >=3.0.0 Censys ASM Inventory Query for OpenSSL >= 3.0.0 OpenSSL vendor vulnerability announcement. **Updates** 2022-11-01 Details of two high-severity vulnerabilities patched in OpenSSL version 3.0.7 are now available (CVE-2022-3786, CVE-2022-3602). Both are buffer overflows in the X.509 certificate verification process, “specifically in name constraint checking.” The first, CVE-2022-3786, […]
The Neverending Story of Deadbolt
Published on 09.10.2022 Introduction Deadbolt, a ransomware campaign haunting QNAP NAS customers for the last few months, has seen a consistent number of infections on a fairly regular cadence. But recently, Censys has observed a massive uptick in Deadbolt-infected QNAP devices. The Deadbolt crew is ramping up their operations, and the victim count is growing […]
Tracking Deadbolt Ransomware Across the Globe
Deadbolt, the ransomware attack that just won’t end, appears to be back for a third round. Our Rapid Response Team has been monitoring the QNAP vulnerability since it first appeared in late January 2022. A quick refresh on QNAP Deadbolt ransomware QNAP is a manufacturer of network-attached storage (NAS) devices. In January of this year, […]
Deadbolt Ransomware is Back
Two months ago, in January of 2022, Censys reported on the spread of a new variant of ransomware dubbed Deadbolt. This ransomware targeted a series of network-attached storage devices (NAS) for consumers and small businesses running the QNAP QTS (Linux-based) operating system. What makes this particular variant unique is its communication with the victim. Instead […]
The QNapping of QNAP Devices
Authors: Mark Ellzey, Aidan Holland, Ryan Lindner Updates: Introduction On Jan. 25, 2022, several media outlets reported a ransomware attack targeting the Network Attached Storage (NAS) vendor QNAP. The news circulated soon after QNAP released a warning statement pleading with customers to “fight ransomware together” by disabling features on consumer routers and the QNAP devices […]