ConnectWise, a prominent IT management software provider, has confirmed a cyber attack attributed to a sophisticated nation-state actor. The breach affected a limited number of customers using its ScreenConnect remote access tool. The company has engaged forensic experts from Mandiant to investigate the incident and is collaborating with law enforcement agencies.
Details of the Breach
The attack exploited two critical vulnerabilities in the ScreenConnect software:
These flaws allowed attackers to gain unauthorised access to systems, deploy malware, and potentially exfiltrate data. Security researchers observed various threat actors, including the LockBit ransomware gang, exploiting these vulnerabilities.
ConnectWise’s Response
Upon discovering the breach, ConnectWise promptly initiated an investigation and implemented enhanced monitoring across its network. The company has patched the identified vulnerabilities and is urging all on-premises customers to update their ScreenConnect installations to the latest version to mitigate potential risks.
Implications for Users
The exploitation of these vulnerabilities underscores the critical importance of timely software updates and robust cyber security practices. Organisations using ScreenConnect, especially those with on-premises deployments, should ensure they have applied the latest patches and review their security protocols to prevent unauthorised access.
Conclusion
This incident highlights the persistent threats posed by advanced cyber actors targeting widely used IT management tools. ConnectWise’s swift response and collaboration with cyber security experts aim to contain the breach and prevent further exploitation. Users are advised to stay vigilant, apply necessary updates, and monitor their systems for any unusual activity.
References:
ConnectWise breached in cyberattack linked to nation-state hackers (thebleepingcomputer.com)
The ConnectWise cyberattack just got a whole lot worse (techradar.com)
ConnectWise ScreenConnect critical CVE lures an array of threat actors(cybersecuritydrive.com)
TikTok, the wildly popular short-form video platform, has become more than just a hub for viral dances and trends—it’s now a growing vector for cyber threats. Recent investigations by cyber security firms have uncovered a disturbing trend: cyber criminals are leveraging TikTok videos to distribute sophisticated malware, targeting unsuspecting users with phishing tactics and info-stealing payloads. This bulletin highlights the nature of the threat, the risks involved, and what users and organisations should do to stay safe.
Attack Details
According to reports from The Hacker News, Trend Micro, and Expel, attackers are embedding malicious links within TikTok video descriptions, comments, or profiles. These links often masquerade as free downloads, exclusive content, or trending tools. Once clicked, users are redirected to phishing sites or prompted to download malware-laced files.
One of the most concerning strains identified is Lactrodectus, a stealthy malware loader named after the black widow spider. As detailed by Expel, Lactrodectus can evade detection, establish persistence, and deliver secondary payloads such as information stealers. Trend Micro’s analysis further reveals that these campaigns are often disguised as legitimate promotions or giveaways, making them particularly effective at luring younger, less cyber aware audiences.
Risk
The risks are significant. Once infected, a user’s device can be compromised in several ways:
Given TikTok’s massive user base—especially amongst teens and young adults—this attack vector has the potential to scale rapidly.
Conclusion
This emerging threat underscores the evolving tactics of cyber criminals who are now exploiting social media platforms not just for scams, but for full-fledged malware distribution. TikTok users must exercise extreme caution when clicking on links, even if they appear in popular or verified accounts. Organisations should consider implementing DNS filtering, endpoint protection, and user awareness training focused on social media threats.
As attackers continue to innovate, so must our defences. Stay vigilant, stay informed—and think before you click.
References:
Hackers Use TikTok Videos to Distribute Vidar and StealC Malware via ClickFix Technique (thehackernews.com)
Following the spiders: Investigating Lactrodectus malware (expel.com)
TikTok Videos Promise Pirated Apps, Deliver Vidar and StealC Infostealers Instead (trendmicro.com)
Recent revelations have once again put D-Link routers in the spotlight for critical security vulnerabilities, specifically those stemming from hard-coded Telnet credentials. This long-standing issue in networking hardware, where fixed login details are embedded directly into a device’s firmware, creates persistent backdoors that malicious actors can exploit to gain unauthorised control.
The Heart of the Problem: Hard-Coded Credentials
Hard-coded credentials are essentially “master keys” built into a device during manufacturing, often for debugging or factory testing. The critical flaw arises when these credentials are not removed or secured before the product ships to consumers. If discovered by attackers – often through reverse-engineering firmware or simply through leaked information – these credentials can allow unauthenticated access to the device’s command-line interface (CLI) via Telnet.
Telnet, being an unencrypted protocol, makes this even more dangerous. Any attacker who can access the router via Telnet can potentially intercept network traffic, change router settings, redirect users to malicious sites, or even use the router as a launchpad for further attacks on other devices within the network or beyond.
Affected Models and Recent Disclosures
While hard-coded credentials have plagued various D-Link models over the years (with some past instances dating back to 2013 and 2016 involving models like DIR-100, DIR-850L, and DWR-932B), new advisories issued in late 2024 and early 2025 highlight fresh concerns for their newer Wi-Fi 6 routers.
Specifically, critical and high-severity vulnerabilities related to hard-coded Telnet credentials have been identified, including:
These vulnerabilities specifically impact several D-Link Wi-Fi 6 router models, including:
The Exploit in Action
Attackers can leverage these hard-coded credentials to bypass standard authentication mechanisms. In some cases, the Telnet service might be hidden or disabled by default but can be remotely activated through specific triggers, such as connecting the WAN port or sending carefully crafted packets. Once Telnet is active and an attacker knows the hard-coded credentials, they gain powerful access to the router’s underlying operating system, potentially leading to a full compromise of the device and the network it controls.
Mitigation and Recommendations
D-Link has acknowledged these vulnerabilities and released security updates to address them. Users and administrators of affected D-Link routers are strongly advised to take immediate action:
A Persistent Problem
The repeated emergence of hard-coded credentials in D-Link products, spanning across different router generations, highlights a systemic issue that continues to pose a significant risk to users. These vulnerabilities serve as a stark reminder that even seemingly innocuous features or testing mechanisms can become critical security holes if not properly handled before a product’s release. For consumers and enterprises alike, maintaining vigilance and promptly applying security updates remains paramount in the ongoing battle against cyber threats.
References:
D-Link fixes critical RCE, hardcoded password flaws in WiFi 6 routers (bleepingcomputer.com)
CVE-2025-46176 : Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR (cvedetails.com)
D-Link Security Announcements (dlink.com)
CVE-2024-45696 (incibe.es)
MA-1160.102024: Critical Vulnerabilities in D-Link Routers (mycert.org)
CVE-2024-45698 (nvd.nist.gov)
CVE-2024-45697 (tenable.com)
Norm tracks and monitors the latest security trends and cyber threats and collates these into a fortnightly threat bulletin.
You can receive this bulletin for free, every fortnight, by entering your business email address below:
