Cybercriminals are pushing the boundaries of their operations, exploiting vulnerabilities in both devices and software ecosystems to widen their reach. The BADBOX botnet, thought to be dismantled, has made a troubling comeback, infecting over 192,000 Android-based devices worldwide. Expanding its scope, BADBOX now compromises high-end smart TVs and smartphones at the supply chain level.

Juniper Networks routers are under siege in a botnet campaign deploying the Mirai malware. Exploiting default credentials, the malware scans the internet for vulnerable devices, infecting systems to launch DDoS attacks and execute malicious commands remotely. Juniper strongly advises users to change default passwords, monitor devices for unusual activity, and update firmware. Infected systems require reimaging to fully eradicate the threat.

Fortinet has issued urgent patches for critical vulnerabilities in its products, including FortiClient VPN, FortiManager, and FortiWLM. The flaws allow attackers to extract VPN passwords, execute remote code, and access sensitive files. With millions of users at risk, Fortinet urges immediate upgrades to secure versions, highlighting the importance of proactive vulnerability management in today’s threat landscape.

Top Malware Reported in the Last 24 Hours

Malicious VSCode extensions target devs

Malicious VSCode extensions targeting developers and cryptocurrency projects were discovered on the VSCode marketplace and NPM. These extensions, disguised as productivity tools and targeting cryptocurrency investors, contained downloader functionality to download heavily obfuscated PowerShell payloads. The threat actors used fake reviews and installation numbers to appear legitimate. The second-stage payloads were designed to execute hidden PowerShell commands to drop further malicious payloads on the compromised system. 

BADBOX botnet resurfaces!

The BADBOX botnet, previously believed to have been dismantled, has re-emerged and expanded to compromise over 192,000 Android-based devices globally. It now infects high-end smart TVs and smartphones at the supply chain level, making detection difficult for consumers and enterprises. The malware performs malicious activities, including ad fraud and account abuse, and communicates with command-and-control servers to download and execute new payloads.

UAC-0125 exploits Cloudflare Workers

The CERT-UA reported that a threat actor named UAC-0125 is using the Cloudflare Workers service to deceive military personnel into downloading malware disguised as Army+, a mobile app launched by the Ministry of Defence. Users who visit fake websites are prompted to download a malicious Windows executable. The malware opens a decoy file while running a PowerShell script that installs OpenSSH and sends the private RSA key to an attacker’s server via the TOR network, allowing remote access to the victim's machine. 

Mirai botnet targets Juniper SSRs

Juniper Networks routers with default passwords are being targeted in a botnet infection campaign, with the Mirai malware infecting systems and launching DDoS attacks. Juniper advises changing default credentials, monitoring for suspicious activity, using strong passwords, and keeping devices updated to reduce the risk of infection. If a system is found to be infected, the only certain way of stopping the threat is by reimaging the system. The malware scans the internet for devices using default usernames and passwords, attempts to gain access, and allows threat actors to execute commands remotely for malicious activities.

Top Vulnerabilities Reported in the Last 24 Hours

Critical flaws in Fortinet products

Fortinet has issued urgent advisories about serious vulnerabilities in its products, including FortiClient VPN, FortiManager, and FortiWLM, which could endanger millions of users. The FortiClient VPN flaw (CVE-2024-50570) allows attackers to extract VPN passwords from memory due to improper handling of information. Users should upgrade to FortiClient versions 7.4.3, 7.2.8, or 7.0.14 or higher. FortiManager has a vulnerability (CVE-2024-48889) that lets authenticated attackers execute remote code, with a CVSS score of 7.2. A critical flaw in FortiWLM (CVE-2023-34990) permits unauthorized access to sensitive files. 

Next.js auth bypass vulnerability spotted

A security vulnerability in the popular Next.js framework (CVE-2024-51479) could have allowed unauthorized access to sensitive application data in versions 9.5.5 through 14.2.14. The vulnerability stemmed from an authorization bypass issue in Next.js middleware, potentially impacting a wide range of applications. The Next.js team has released a patch in version 14.2.15 and later, urging developers to update their applications immediately.