Features Category

security advisoryransomwarelinux

BERT: Cross-Platform Ransomware Targeting Linux and ESXi Systems

Ransomware is nothing new to us as Linux admins and infosec folks—it’s pretty much part of the modern threat landscape now. But when I say "BERT ransomware," you may want to sit up and pay closer attention. Officially tracked as "Water Pombero" by Trend Micro, BERT isn’t just another ransomware strain making a splash. It’s a calculated, cross-platform threat that specifically hones in on both Windows and Linux systems. Oh, and for those of you running ESXi in your virtualized data centers? BERT has you in its crosshairs, too. . Here’s the thing: this group (active since April) isn’t just adapting toolkits from dismantled ransomware gangs like REvil and Babuk, but they’ve also figured out how to tweak their methods for maximum disruption. The days of depending on obscurity to avoid trouble are long past—this one operates like it knows your playbook. Let’s break down why this matters, especially for us Linux folks, and what you can actually do about it. BERT's Linux Playbook: Faster, Smarter, Meaner So, what’s the deal with the Linux variant of BERT? The short version: it’s fast, versatile, and it’s bringing a serious problem to virtualized environments. The ransomware leverages multithreaded encryption—up to 50 threads—so it can scramble your data faster than you can react. It’s not subtle either. Files hit by the attack get slapped with the .encrypted_by_bert extension, and you’re left staring at a ransom note named encrypted_by_bert-decrypt.txt. Here’s what makes it nasty in a Linux environment: Targeting ESXi virtual machines: BERT doesn’t nibble around the edges—it goes straight for your critical resources. Once it’s on a system, it forcibly shuts down ESXi VMs to ensure maximum downtime. No running VMs means no quick recovery. For any of you who rely on ESXi to manage large-scale virtualized workloads, that's a nightmare scenario. Threaded encryption: You can actively pass arguments like --threads when launching the ransomware.This is not some cobbled-together script. It’s modular and customizable, which makes it more effective and harder to predict. Configuration baked in: Everything this ransomware needs (public key, ransom note encoding, and so on) is embedded directly in its binary as JSON-formatted configuration data. That means no fiddling around—it's just plug, play, and wreck your day. And if the architecture feels familiar, it should. Trend Micro has noted code-level similarities to the dismantled REvil and Babuk ransomware gangs, which shows this isn’t built from scratch; instead, it’s a Frankenstein of prior frameworks. That alone should tell you this threat is purposeful, not opportunistic. The Evolution of BERT (From Clunky to Streamlined) One of the scariest parts about BERT is how quickly it’s evolving. If we look back at the earlier versions, they were straightforward but sort of limited. The first versions would collect file paths in arrays and then encrypt them sequentially. Not efficient, right? The newer variants, however, lean on ConcurrentQueue logic and DiskWorkers for each drive. This lets it immediately begin encryption as it detects files. Nothing sits in a static queue—it’s just constant movement. This refinement isn’t just about speed; it’s about limiting your window to stop the process. And that makes it a whole different beast. Who’s in the Firing Line? If you’re thinking, This doesn’t affect my setup, maybe think again. Healthcare, tech companies, and event services seem to be the primary targets, but let's be real: if you’re running ESXi or Linux cloud servers, you’re in the territory that BERT is designed to exploit. Hospitals, for instance, often have older systems that virtually guarantee vulnerabilities. Tech outfits rely heavily on virtual machines (think CI/CD pipelines or cloud environments). And event services? Downtime kills them faster than poor ticket sales. Here’s the kicker: BERT’s campaigns have shown upeverywhere—Asia, Europe, the U.S. It’s indiscriminate. How Can I Build My Defense Line? So, how do we fight it? The bad news is there’s no magic button to protect yourself from ransomware. The good news? There’s still a lot you can do to reduce your risk and contain incidents if they happen. Keep Systems Patched Sure, this feels like an obvious one, but how many times have you glanced at a pending kernel or hypervisor update and said, I’ll handle that later? Don’t. Especially if you’re running VMware ESXi, keeping it patched should be non-negotiable. Backups, Backups, Backups Immutable backups (the kind ransomware can’t touch) are your best friend. Store them offline. Test your recovery workflow before you’re panicking and your phone’s ringing off the hook. A backup is useless if you find out too late that it’s incomplete or corrupted. Control Access Like a Maniac If your admins all have full access to everything, you’re just asking for trouble. Use role-based access control (RBAC) to enforce least privilege practices. And segment your network—your ESXi servers shouldn’t be sitting in the same environment as day-to-day user machines. Isolate critical stuff as much as you can. Monitor Weird Activity Use a SIEM solution to flag anything out of the ordinary—file encryption attempts, random PowerShell processes firing off, or unusual outbound traffic (like the IPs BERT’s been seen pinging). There’s no perfect detection, but proactivity is better than nothing. Lock Down Virtualization If you’re running virtual machines, make sure you’ve tightened up the ESXi hosts: Disable SSH access. Configure ESXi-specific firewalls to block unnecessary traffic. Keep an eye out for unexpected VM shutdowns—BERT loves to kill virtualized resources. Train the Humans I know, user training gets real old, real fast. But ransomware often gets in because someone clicked a bad link in an email or ran an attachment without thinking. Themore suspicious your employees are of emails and weird files, the less likely this stuff is to land in your environment. Our Final Thoughts: Keep an Eye On This One Here’s the bottom line: BERT shows how ransomware is targeting Linux and ESXi environments more than ever. We can’t afford to treat ransomware as someone else’s problem, or as something mainly aimed at Windows. The inclusion of multithreaded encryption and the calculated focus on virtualized data centers are clear signals—this group is playing smart and aggressively. Treat this as your heads-up to scrutinize your security stack, rethink your backups, and assume your systems will eventually be targeted. Whether you’re running Linux at scale in a sprawling enterprise or hosting services on an ESXi cluster, the same principles apply: strengthen everything. Because with adversaries like BERT, you don’t get time for hindsight. . BERT ransomware targets Linux and ESXi systems, offering key defense strategies for admins and infosec professionals.. ransomware, nothing, linux, admins, infosec, folks—it’s, pretty. . Brittany Day

Jul 09, 2025 •

Brittany Day

risk managementLinux securityransomware

Linux Ransomware Attack Breakdown: Strategies for Protection

Ransomware has been making life miserable for IT folks for years now, and you’ve probably heard plenty about how it hits Windows systems . But Linux? Yeah, that’s not off-limits anymore. In fact, attackers are seeing Linux as an appealing target—servers running critical enterprise networks, government systems, and big databases that power everything from websites to operations. Anything important enough to cause chaos if it’s compromised, especially where someone’s willing to shell out money to get it back, gets a big bullseye on it. Sure, the majority of ransomware still goes after Windows machines, but if you’re thinking, “Linux is safe because fewer people target it,” that’s a gamble you don’t want to take these days. The methods attackers use are evolving, and even though Linux ransomware is still less common, the attacks themselves are clever, nasty, and diverse. . What’s scary here isn’t just the damage these attacks cause—encrypted files, downtime, reputation hits, and recovery costs—it’s how they sneak their way onto Linux systems in the first place. They exploit vulnerable setups, outdated software, misconfigurations, and anything careless or overlooked. The attack process itself is almost methodical, like breaking into a house and systematically going through every room. But knowing how these attacks work—and, more importantly, how to stop them—can make a big difference. Let’s break down what’s happening in these Linux-targeted ransomware attacks step by step so you have a clearer picture of the threat. Plus, we’ll talk about how to lock things down and avoid being the next “news headline.” Anatomy of a Linux Ransomware Attack Linux ransomware has become known for the sophistication and diversity of its tactics, methods, and techniques to compromise systems and generate profits for its operators. Ransomware attacks targeting Linux systems are generally carried out in a series of clearly defined steps, beginning with exploiting one or multipleunpatched vulnerabilities and ending with a payday for the attackers. Let’s take a closer look at the anatomy of a Linux ransomware attack, broken down step-by-step, to help you better understand this growing threat to your systems and your data. Step 1: Infection Unlike Windows ransomware variants, which spread via email or mall advertising, Linux ransomware infection relies on vulnerability exploitation. Linux ransomware exploits either unpatched system vulnerabilities or flaws in a service, such as a web server or email server, to obtain access to a target system and compromise files. For instance, the infamous Lilocked ransomware exploits out-of-date versions of the Exim message transfer agent to gain a foothold in a target environment. Rex, another dangerous strain of Linux ransomware, uses vulnerability scanners specific to Drupal, WordPress, Magento, Kerner, Airos, Exagrid, and Jetspeed to detect SQL injection vulnerabilities that can be exploited to gain admin credentials. Once in the target environment, the ransomware operator “phones home” to download a hidden executable by connecting to a predefined list of IP addresses that host the command-and-control (C2) server. At this point, the attacker typically copies the malicious executable to a local directory, such as the Temp folder, and then terminates and removes the script. The malicious payload is now executed in the target environment. Linux ransomware strains often possess privilege escalation capabilities, such as those seen in the notorious Lucifer and NotPetya variants. These advanced features enable ransomware operators to access parts of a system that would be inaccessible without privileged access. While Linux ransomware typically only affects those using the web server that is compromised, privilege escalation can magnify both the scope of an attack and its overall impact. Step 2: Staging This step can be seen as the “housekeeping” portion of a Linux ransomware attack. The ransomware sets itself up for smoothoperation by attending to various items, including moving itself to a new folder and establishing persistence in the target environment, giving it capabilities such as the ability to run at boot, to run when in recovery mode, and to disable recovery mode altogether. At this stage of the attack, the ransomware communicates with the C2 server to negotiate its public key, which the operator generates and places in the ransomware to encrypt the randomly generated symmetric key. Step 3: Scanning Now that ransomware has established persistence and set itself up for success. It is prepared to encrypt target files. The ransomware scans compromised systems for a predefined list of file extensions and cloud file storage repositories of interest, mapping the locations of these files and repositories. Step 4: Encryption The encryption phase of an attack is when the real damage is done. Up until this point, nothing potentially irreversible has happened - the malware has simply set itself up and surveyed the target environment. Now, the ransomware creates an encrypted version of the target files using a random symmetric key. It generates and encrypts the symmetric key with its public key. It then deletes the original version of the files it has encrypted. For every location where files have been encrypted, copies of auto-generated ransom notes are created in multiple formats. Step 5: Extortion Once the encryption process is complete, a ransom note providing explicit payment instructions is displayed as the victim's desktop wallpaper. At this point, the ransomware terminates and deletes itself, as its mission in the target environment is complete. Meanwhile, ransomware operators wait for ransom to be paid in untraceable Bitcoin to a wallet they own. The victim must decide if he or she is willing to pay the ransom in exchange for the decryption of locked files or accept the fact that the files encrypted in the attack are permanently inaccessible. It is often helpful to enlist a ransomware recovery firmat this point, as they can offer advice and, in some cases, locate a decryption key that can be used to recover locked files. Final Thoughts & Best Practices for Protecting Against Linux Ransomware Let’s be real—Linux ransomware might not dominate headlines the way Windows ransomware does, but it’s a growing problem, and ignoring it is a mistake. The good news is that you’re already a step ahead by understanding how these attacks work and what they typically target. But here’s the thing: a lot of these compromises boil down to unpatched systems or sloppy administration. It’s not flashy, but staying on top of patches , cleaning up permissions, and verifying your configurations regularly can go a long way. Don’t assume your server’s safe just because it’s running Linux—that mindset’s outdated. Even small gaps, like a forgotten web server vulnerability or a missed security audit, create an opening for ransomware. And trust me, when ransomware hits, it’s not just a technical headache—it’s scrambling to fix broken systems while everyone else is demanding answers. So, what can you do today? Start with backups —seriously, I’ve seen too many people regret half-baked backup strategies when things go south. Make backups solid, spread them across different media, and test them once in a while. Then, tighten up access controls . If users don’t need access, they shouldn’t have it. IDS and IPS tools might sound like overkill for some setups, but they can be game-changers in spotting weird traffic early. And don’t forget regular audits—it’s boring, I know, but they can unearth issues before attackers do. This isn’t about chasing perfection; it’s about minimizing risk and staying prepared. Linux is resilient, sure, but ransomware doesn’t care about all that—it cares about the cracks. So, close them up! . Ransomware targets Linux systems, causing costly damage. Learn strategies to protect against these attacks effectively.. ransomware, making, miserable, folks,years, you’ve, probably, heard. . Brittany Day

Jun 05, 2025 •

Brittany Day

attackransomwaresecurity awareness

Understanding Linux Ransomware Attack Steps and Protection Strategies

Ransomware has been making life miserable for IT folks for years now, and you’ve probably heard plenty about how it hits Windows systems . But Linux? Yeah, that’s not off-limits anymore. In fact, attackers are seeing Linux as an appealing target—servers running critical enterprise networks, government systems, and big databases that power everything from websites to operations. Anything important enough to cause chaos if it’s compromised, especially where someone’s willing to shell out money to get it back, gets a big bullseye on it. Sure, the majority of ransomware still goes after Windows machines, but if you’re thinking, “Linux is safe because fewer people target it,” that’s a gamble you don’t want to take these days. The methods attackers use are evolving, and even though Linux ransomware is still less common, the attacks themselves are clever, nasty, and diverse. . What’s scary here isn’t just the damage these attacks cause—encrypted files, downtime, reputation hits, and recovery costs—it’s how they sneak their way onto Linux systems in the first place. They exploit vulnerable setups, outdated software, misconfigurations, and anything careless or overlooked. The attack process itself is almost methodical, like breaking into a house and systematically going through every room. But knowing how these attacks work—and, more importantly, how to stop them—can make a big difference. Let’s break down what’s happening in these Linux-targeted ransomware attacks step by step so you have a clearer picture of the threat. Plus, we’ll talk about how to lock things down and avoid being the next “news headline.” Anatomy of a Linux Ransomware Attack Linux ransomware has become known for the sophistication and diversity of its tactics, methods, and techniques to compromise systems and generate profits for its operators. Ransomware attacks targeting Linux systems are generally carried out in a series of clearly defined steps, beginning with exploiting one or multipleunpatched vulnerabilities and ending with a payday for the attackers. Let’s take a closer look at the anatomy of a Linux ransomware attack, broken down step-by-step, to help you better understand this growing threat to your systems and your data. Step 1: Infection Unlike Windows ransomware variants, which spread via email or mall advertising, Linux ransomware infection relies on vulnerability exploitation. Linux ransomware exploits either unpatched system vulnerabilities or flaws in a service, such as a web server or email server, to obtain access to a target system and compromise files. For instance, the infamous Lilocked ransomware exploits out-of-date versions of the Exim message transfer agent to gain a foothold in a target environment. Rex, another dangerous strain of Linux ransomware, uses vulnerability scanners specific to Drupal, WordPress, Magento, Kerner, Airos, Exagrid, and Jetspeed to detect SQL injection vulnerabilities that can be exploited to gain admin credentials. Reliable backups remain one of the most effective defenses against ransomware, and for Linux-hosted e-commerce platforms, a well-planned Magento 2 backup approach is essential to restoring operations without paying attackers. Once in the target environment, the ransomware operator “phones home” to download a hidden executable by connecting to a predefined list of IP addresses that host the command-and-control (C2) server. At this point, the attacker typically copies the malicious executable to a local directory, such as the Temp folder, and then terminates and removes the script. The malicious payload is now executed in the target environment. Linux ransomware strains often possess privilege escalation capabilities, such as those seen in the notorious Lucifer and NotPetya variants. These advanced features enable ransomware operators to access parts of a system that would be inaccessible without privileged access. While Linux ransomware typically only affects those using the web server that is compromised,privilege escalation can magnify both the scope of an attack and its overall impact. Step 2: Staging This step can be seen as the “housekeeping” portion of a Linux ransomware attack. The ransomware sets itself up for smooth operation by attending to various items, including moving itself to a new folder and establishing persistence in the target environment, giving it capabilities such as the ability to run at boot, to run when in recovery mode, and to disable recovery mode altogether. At this stage of the attack, the ransomware communicates with the C2 server to negotiate its public key, which the operator generates and places in the ransomware to encrypt the randomly generated symmetric key. Step 3: Scanning Now that ransomware has established persistence and set itself up for success. It is prepared to encrypt target files. The ransomware scans compromised systems for a predefined list of file extensions and cloud file storage repositories of interest, mapping the locations of these files and repositories. Step 4: Encryption The encryption phase of an attack is when the real damage is done. Up until this point, nothing potentially irreversible has happened - the malware has simply set itself up and surveyed the target environment. Now, the ransomware creates an encrypted version of the target files using a random symmetric key. It generates and encrypts the symmetric key with its public key. It then deletes the original version of the files it has encrypted. For every location where files have been encrypted, copies of auto-generated ransom notes are created in multiple formats. Step 5: Extortion Once the encryption process is complete, a ransom note providing explicit payment instructions is displayed as the victim's desktop wallpaper. At this point, the ransomware terminates and deletes itself, as its mission in the target environment is complete. Meanwhile, ransomware operators wait for ransom to be paid in untraceable Bitcoin to a wallet they own. The victim must decideif he or she is willing to pay the ransom in exchange for the decryption of locked files or accept the fact that the files encrypted in the attack are permanently inaccessible. It is often helpful to enlist a ransomware recovery firm at this point, as they can offer advice and, in some cases, locate a decryption key that can be used to recover locked files. Final Thoughts & Best Practices for Protecting Against Linux Ransomware Let’s be real—Linux ransomware might not dominate headlines the way Windows ransomware does, but it’s a growing problem, and ignoring it is a mistake. The good news is that you’re already a step ahead by understanding how these attacks work and what they typically target. But here’s the thing: a lot of these compromises boil down to unpatched systems or sloppy administration. It’s not flashy, but staying on top of patches , cleaning up permissions, and verifying your configurations regularly can go a long way. Don’t assume your server’s safe just because it’s running Linux—that mindset’s outdated. Even small gaps, like a forgotten web server vulnerability or a missed security audit, create an opening for ransomware. And trust me, when ransomware hits, it’s not just a technical headache—it’s scrambling to fix broken systems while everyone else is demanding answers. So, what can you do today? Start with backups —seriously, I’ve seen too many people regret half-baked backup strategies when things go south. Make backups solid, spread them across different media, and test them once in a while. Then, tighten up access controls . If users don’t need access, they shouldn’t have it. IDS and IPS tools might sound like overkill for some setups, but they can be game-changers in spotting weird traffic early. And don’t forget regular audits—it’s boring, I know, but they can unearth issues before attackers do. This isn’t about chasing perfection; it’s about minimizing risk and staying prepared. Linux is resilient, sure, but ransomwaredoesn’t care about all that—it cares about the cracks. So, close them up! . Discover how Linux ransomware attacks occur and effective strategies to prevent and recover from them.. Linux Ransomware, Attack Strategies, Mitigation Techniques, Security Awareness, System Protection. . Brittany Day

Jun 05, 2025 •

Brittany Day

security advisorybackup strategiesransomware

Strengthening WordPress Security on Linux: Key Strategies & Threats

Did you know that 43.1% of websites on the Internet run on WordPress, according to W3Techs? Most WordPress websites run on Linux servers, which makes them prime targets for hackers—these servers experience approximately 90,000 attacks each minute! . As the owner or admin of a WordPress website, security should always be your top priority. You must monitor vulnerabilities within WordPress and third-party plugins for potential vulnerabilities and exploits that could result in website defacement, malware infections , data breaches, downtime, and other damaging repercussions. Luckily, there are proven strategies for securing your WordPress website, which we'll discuss here. Why Is WordPress Security Critically Important? Maintaining the security of a WordPress site is paramount, whether for personal or professional use. Unfortunately, many beginners overlook security when setting up new WordPress sites, which can prove costly in terms of reputation damage and lost business revenue. WordPress security risks are on the rise mainly because it's so popular, making it a prime target for cybercriminals. Many sites rely on a lot of third-party plugins for added features, but if these plugins aren't updated regularly or properly vetted, they can introduce vulnerabilities. Many WordPress sites are running outdated plugins that haven't been patched in years. Even when patches are available, not everyone updates right away. The enormous variety of themes and plugins, all created by different developers, adds to the difficulty in maintaining robust security across the entire WordPress ecosystem. Worse yet is the persistent ransomware threat to WordPress sites. Hackers can gain entry to vulnerable WordPress sites and lock up all files before demanding payment to unlock them. Worse yet, sometimes these attackers can’t even unlock these files themselves, leaving you with financial damage and a broken site! Below, we will examine some common WordPress vulnerabilities and security threats thatadmins face. What Are Common WordPress Vulnerabilities? To protect your WordPress site from persistent and emerging attacks, you must first understand some common vulnerabilities that hackers exploit. The following are the most prevalent and problematic WordPress vulnerabilities that may lurk within a typical WordPress installation. Outdated Software The most common vulnerability you'll find in WordPress websites is outdated software. This may include the use of an outdated WordPress version, as well as the use of outdated plugins inside the CMS. You need to update a WordPress installation and its plugins to ensure your site is secure from software flaws that newer versions don't have. Worse still, many of those flaws become common knowledge to hackers once developers issue a software update, placing outdated sites at even greater risk. Despite the risk, over 21% of known WordPress websites still use older, unsupported versions of the CMS. Vulnerable Plugins & Themes Vulnerable WordPress plugins can be a real headache and danger for users because they open the door to various security problems. Imagine these plugins like unlocked windows in your house—hackers can easily slip through to wreak havoc. They might install other dodgy plugins without you knowing or even mess with your website’s code to do harmful things like steal data. It's essential to monitor your plugins and ensure they're updated to the latest, safest versions. Otherwise, you're leaving your site vulnerable to an array of attacks. A recent critical vulnerability in the Hunk Companion plugin (tracked as CVE-2024-11972 ) demonstrates the risk of vulnerable WordPress plugins. This flaw, found by WPScan, is being actively exploited to install vulnerable plugins, creating significant security risks. This flaw, which affects all versions of Hunk Companion before 1.9.0 and has a CVSS score of 9.8, enables attackers to exploit Remote Code Execution (RCE), SQL Injection, Cross-Site Scripting (XSS) , and other maliciousactivities by installing or reactivating compromised or outdated plugins. Despite the availability of the fix, only 11.6% of users have upgraded, leaving approximately 8,800 sites still at risk. Another critical vulnerability was recently found in the popular WordPress security plugin Really Simple Securit, which has put over four million websites at risk. This bug allows attackers to log in as any user, including admins, without needing a password, thereby gaining full access to the site's permissions. The ease of exploitation and potential for severe consequences, such as malware injection, unauthorized content changes, and attacks on visitors, have earned this vulnerability a CVSS score of 9.8 out of 10. Just recently, some big security holes were found in the Woffice WordPress theme, used on thousands of websites. These issues could let bad actors take control of your site by registering with admin privileges or logging in as any user - including you! Weak Passwords Weak passwords are also a persistent vulnerability for WordPress websites. Hackers exploit weak passwords by targeting administrator accounts that can grant them complete control of a WordPress site. From there, nothing stops them from wreaking havoc and making whatever changes they wish. Shared Hosting Although shared hosting is popular for WordPress website owners, it has significant security vulnerabilities . If an attacker manages to execute a privilege escalation attack on the underlying server, they gain unfettered access to every WordPress website it hosts, too. Lack of Server Hardening Another common vulnerability present in WordPress websites is a lack of server hardening. The default installation of the WordPress CMS leaves various features turned on for the convenience of the site's owner. However, some of those features, such as the built-in file editor, the hotlinking function, PHP execution, and directory browsing, can be powerful weapons in the hands of an attacker. Using those functions, an attackercould execute malicious code, conduct a cross-site scripting attack , or enable a denial-of-service attack. Incorrect File Permissions Misconfigured file permissions are another common vulnerability found in WordPress websites. Generally speaking, the underlying wp-content and wp-admin folders that house most of a WordPress site's files should have restricted file permissions, including a restriction on who can write to them. However, plenty of novice admins change those default permissions while trying to troubleshoot configuration issues and fail to change them back, creating a major vulnerability. Essential WordPress Security Tips & Best Practices for Linux Users To combat the vulnerabilities discussed above, owners and operators of WordPress Websites must follow established WordPress security best practices to the letter. Here's what they are and some other tips on keeping WordPress sites secure. Keep Software & Plugins Updated The most important way to keep a WordPress website secure is to update the CMS to the latest version and enable auto-updates for the future. Plus, it's equally important to keep all installed plugins up to date, too. This means checking with plugin developers regularly or installing software that can check for new plugin versions and make the necessary updates for you. Keeping WordPress plugins up-to-date will protect against bugs like the previously mentioned CVE-2024-11772 and the recently identified critical flaw in the Really Simple Security WordPress plugin. Admins must monitor security advisories vigilantly and apply the latest WordPress software and plugin patches as soon as they are released. Be Wary of the Software Packages You Install WordPress users should be vigilant about the software packages they install, preferably sticking to direct downloads from verified sources. A recent sophisticated yearlong supply-chain attack reported by security firms Checkmarx and Datadog demonstrates the importance of this WordPress security best practice. The attack involves malicious actors distributing Trojanized versions of open-source software, specifically through the NPM repository and GitHub, to infect devices. One such package, @0xengine/xmlrpc, masquerades as a legitimate JavaScript implementation but contains a backdoor that activates malicious code, resulting in attackers stealing credentials and other sensitive information, including SSH private keys and AWS access keys. A second package, yawpp, indirectly installs this malware by requiring @0xengine/xmlrpc as a dependency. This malware campaign has resulted in approximately 390,000 stolen WordPress credentials and has persisted due to its subtlety and strategic updates. Install & Configure a Firewall Installing a firewall is another excellent way to keep a WordPress website secure. WordPress-specific firewall software can monitor incoming and outgoing data for signs of malicious activity. Plus, many can halt DDoS attacks in progress and block vulnerability scans that alert hackers to exploitable site vulnerabilities. We recommend focusing on WordPress plugins to keep the process of adding a firewall as simple as possible. Using add-ons will be the most straightforward option. WordPress Firewall Rules to adhere to when configuring your firewall can be found here. Scan for Malware & Security Threats It's also good to perform periodic scans of your WordPress website to detect any malware or security threats that may have slipped by your site's defenses. Various tools can scan WordPress sites for such things, and many of the best ones are totally free, too. WPScan is an invaluable tool for Linux administrators looking to protect their WordPress sites from malware and other persistent threats. By scanning for malware and security risks, WPScan allows admins to identify issues such as outdated plugins, vulnerable themes, and weak passwords that need fixing. Installation is quick and painless, and its vulnerability database updates regularly to protect against new threats,making life simpler for administrators who want to maintain secure, healthy websites. Secure WordPress Usernames & Passwords Defining and enforcing a secure password policy is another best practice for securing a WordPress website. At a minimum, the policy should insist on passwords of at least 20 characters, which include letters, numbers, symbols, and a mix of capital and lowercase letters. Installing a two-factor security plugin that adds a time-limited one-time password to every login into the WordPress front-end or back-end is also advisable. Set Up Off-Site Backups Maintaining complete and current offsite backups of a WordPress website is a critical bulwark against malware intrusions and ransomware attacks. Having multiple backup versions of a WordPress website spanning a reasonable amount of time is important. This allows you to restore a version of your WordPress website before malware or ransomware infiltration. Plus, having the backup copies offsite eliminates any chance that a successful server-side attack will compromise them, too. Limit Login Attempts Limiting login attempts is another best practice for guarding a WordPress website against brute-force password attacks. To do it, you can configure your website to lock a user account after a reasonable number of login attempts. You can also set it to ban connections from the IP address associated with the failed login attempts. While these measures alone won't stop a hacker in their tracks, they will significantly slow their efforts to harm your site. Use HTTPS for Encrypting Data Switching your WordPress site over to HTTPS is vital for security and trust. HTTPS protects information by encrypting data sent between visitors, making it hard for hackers to intercept and read personal details like passwords or sensitive financial data. In addition, it ensures users communicate directly with your authentic website, protecting against man-in-the-middle attacks. Plus, search engines prefer sites using HTTPS, as they won't appear as"Not Secure" in browsers - improving both search rankings and trust among visitors. To enable HTTPS on your site, purchase and install an SSL certificate from your hosting provider. Afterward, modify WordPress settings so your URL includes s:// rather than ://. Additionally, force all traffic through HTTPS while simultaneously addressing mixed content issues with plugins like Really Simple SSL for enhanced peace of mind for both visitors and you alike. Secure File Permissions & Ownership As previously mentioned, it's important to set the proper file permissions and ownership for the files associated with a WordPress website. Most WordPress folders should be 755, and most individual files should be 644. Of course, there are always exceptions to those generalities, so it's important to follow all relevant WordPress and plugin documentation and to check trustworthy guides on the subject. Use an Uptime Monitor Uptime monitors can be a useful security tool because they can alert you to a problem with your WordPress site as soon as it happens. When there's any possibility of a malicious intrusion, every second counts. An uptime monitor could warn to block an attack in progress or at least blunt its damage. Add ReCAPTCHA in WordPress Login In addition to the aforementioned two-factor authentication, it's also advisable to add ReCAPTCHA functionality to your WordPress site's login pages and user forms. Various plugins make this easy, and installing one can safeguard your site against botnets, spam, and attacks from sketchy shared IP addresses. Conduct Security Audits & Penetration Testing Since no WordPress security scheme will ever be perfect, conducting regular security audits is an excellent way to ensure your site complies with the previously covered security best practices. It is also good to perform penetration testing to ensure your security measures work as intended. Implement Robust Monitoring & Logging Practices Finally, every WordPress website should include robustmonitoring and logging . The logs generated by the WordPress installation and any plugins can be treasure troves of useful data. For example, your site logs may reveal intrusion attempts by hackers and even clue you into specific vulnerabilities they may be looking to exploit. Various plugins will aggregate your logs into a single interface and even send you alerts based on predefined preferences. Our Final Thoughts on Improving WordPress Security on Linux Webservers At the end of the day, WordPress, running on one Linux variant or another, is and will continue to be the backbone of the Internet. However, it's incumbent upon every WordPress website owner to do their part to keep their sites safe from exploitation. With knowledge of the most common vulnerabilities and the best practices to mitigate them, securing your WordPress site is easier than you think! With a bit of effort and vigilance, running a secure WordPress website is well within reach of even a beginner web admin. Have additional questions? Reach out to us @lnxsec - we’re here to help! . Safeguard your Linux-based WordPress platform by adhering to optimal strategies regarding firewalls, malware defenses, and regular software maintenance.. WordPress Security Best Practices, Linux Server Protection, Web Threat Mitigation. . Duane Dunston

Dec 17, 2024 •

Duane Dunston

network securitycybersecurityransomware

IceFire Ransomware: Tactics, Protection, and Security Practices for Linux

IceFire Ransomware, which already utilizes exploits in cybersecurity to attack Linux systems, has recently developed a new strain . This threat takes advantage of an IBM Aspera Faspex file-sharing vulnerability ( CVE-2022-47986 ) that had previously only targeted Windows systems and media and entertainment companies. Since Linux systems tend to be quite powerful in mitigating risks, IceFire Ransomware is all the more concerning, as it can breach robust cybersecurity systems and cause substantial harm. . The ransomware operators' tactics are consistent with those of the "Big-Game Hunting (BGH)" ransomware families, as the variant focuses on attacking large enterprises, leveraging double extortion, utilizing evasion techniques like deleting log files, and implementing numerous persistence mechanisms. Double extortions are detrimental since these attacks in network security typically demand twice as much for the ransom payment. As network security issues rise, you must stay up-to-date on the latest security news. Knowing the best security practices can help you mitigate risks before they damage your server. This article will review ransomware, dive into IceFire Ransomware, and show you how to protect your server. What Is Ransomware? Ransomware cybercriminals focus on breaching a company’s system, decrypting sensitive files and valuable data, and forcing victims to pay a ransom, or a large sum of money, before returning company work to employees. This type of malware is more damaging to a business than typical malware and phishing email attacks since money is involved. What Does a Ransomware Attack Look Like? During a ransomware attack, users might receive a phishing email that appears to be from a trustworthy sender due to the use of social engineering tactics. Users will open the message and download attachments or links that lead to legitimate-looking documents and websites. Then, cybercriminals can install ransomware they please onto a server, infecting a system and taking away primaryaccess to data companies need for daily operations. What is IceFire Ransomware and its Characteristics? IceFire Ransomware on Linux systems comes across as 2.18 MBs, 64-bit Executables, and Linkable Binary Files (ELF) with open-source GNU Compiler Collection (GCC) for AMD64 system processor architecture. Cybercriminals deployed the services against CentOS hosts so they could run successfully on Intel-based Ubuntu and Debian distributions. Impacted systems download the IceFire payloads, execute them to encrypt files, and rename them with the ".ifire" extension. Then the payload stealthily deletes itself to avoid detection. IceFire Linux payload scripts exclude encryption for specific system-critical files and paths like the following: .cfg, .o, .sh, .img, .txt, .xml, .jar, .pid, .ini, .pyc, .a, .so, .run, .env, .cache, .xmlb, p, /boot, /dev, /etc, /lib, /proc, /srv, /sys, /usr, /var, /run. This intentional deletion prevents encryption so companies can still operate their server. The variant exploits cybersecurity vulnerabilities by implementing itself into the system rather than relying on phishing emails and third-party frameworks. As a result, network security threats may go undetected for an extended period while devising a plan of attack. Once the business faces a breach, there is very little they can do to stop it since the cybercriminals have done extensive research when sitting inside the company's server for so long. The Linux IceFire ransomware payload uses an RSA encryption algorithm with an RSA public key hard-coded into the binary. The payload drops a ransom note from an embedded resource and writes it to each directory targeted for file encryption. The ransom note includes a predefined username and password that you must use to access the ransom payment website hosted on a Tor hidden service to ensure anonymity. How Could IceFire Break Into Secure Linux Systems? Linux security expert and LinuxSecurity.com Founder Dave Wreski remarks, “Linux presents more challenges forransomware operators than Windows, especially on a large scale. Many Linux systems are servers less susceptible to common infection methods like phishing or drive-by downloads. Thus, attackers have resorted to exploiting application vulnerabilities, as we have recently seen with the IceFire ransomware group.” How Can I Secure My Linux Systems Against IceFire Ransomware? Cybercriminals target Linux operating systems more frequently since their highly secure servers outperform Windows and macOS in data and network security. More online customers rely on Linux to power a company's high-value devices as the necessity for email protection skyrockets. Malware , rootkits , and more malicious network security threats put Linux users at risk even more as the system popularizes. Unfortunately, we know only one threat management platform that can combat and stop evasive ransomware attacks in network security: Vali Cyber's ZeroLock . What is ZeroLock? How Can It Protect Against IceFire? ZeroLock rapidly and reliably reacts to attacks in network security by deploying email security solutions that effectively combat malware, rootkits, and ransomware. This service injects code into all aspects of a system so it can monitor the controls organizations use frequently. ZeroLock can suspend, delete, or cache any files, links, or downloads that it considers suspicious. Cybersecurity hardening with ZeroLock keeps cloud security breaches far away from your business and ensures email protection throughout your server. What Other Email Security Options Do I Have to Combat Threats? If you are searching for solutions to add to your security tactics on top of Vali Cyber’s ZeroLock, consider implementing these best email security practices that can improve security posture in your Linux system: Stay up-to-date on the latest cybersecurity vulnerabilities impacting your systems. Register as a LinuxSecurity user, subscribe to our Advisory Watch newsletter, and customize your advisories based on distros toknow the latest security news that could cause network security issues for your business. Follow @LS_Advisories on X for real-time updates. Avoid a Single Point of Failure (SPOF) attack by backing up critical files and diversifying your storage media so cybercriminals cannot utilize repetition in a breach. This solution will not stop attacks, but it can mitigate damage. Integrate the principle of least privilege for your users so accounts only provide the access an employee needs and nothing more, reducing the likeliness of an internal breach. Monitor network activity and system logs closely to stop any attack or risk as quickly as possible. Identify anomalous behavior when keeping tabs on event activity. Regularly checking prevents harm from reaching your company. Use a combination of IP filtering, an Intrusion Detection System (IDS), and an Intrusion Prevention System (IPS). These three options can quickly improve security posture and combat more network security threats. Use Linux security extensions that control and restrict access to data or network resources. Such applications will prevent cybersecurity vulnerabilities from being abused during a possible attack. Implement robust network segmentation and data compartmentalization to minimize the impact of a potential ransomware attack. Utilize cloud security audits on systems regularly. Test them and utilize security patching as needed to prevent any risk that could severely harm the productivity of your business. Our Final Thoughts on Securing Linux Systems Against Ransomware Understanding the data and network security issues you may face during a ransomware attack is vital in guaranteeing your company knows how to protect itself from such threats in the first place. IceFire can encrypt files and delete itself from servers to go undetected when hacking into a system and inflicting damage. Although IceFire Ransomware is not the most significant risk out there, it can be detrimental to a business, especially considering itcan get through Linux security systems, which are relatively defensive in their approach to email security. Fortunately, you can utilize various solutions to prevent an IceFire attack from reaching your organization. Wreski concludes, "Linux ransomware is a serious and increasingly prevalent threat, but luckily, attacks can be prevented with sound administration, the implementation of the right technology, and the other security best practices shared in this article." Continue learning how to strengthen your server's email protection by checking out our blog and articles about other types of ransomware and phishing attacks reaching Linux systems. . Discover IceFire ransomware's strategies and implement robust measures to protect Linux environments from evolving cyber threats successfully.. IceFire Ransomware, Linux Security Threats, Protect Linux Servers, Ransomware Prevention Tips, Cybersecurity Practices. . Brittany Day

Mar 13, 2023 •

Brittany Day

LinuxSecurity ValiCyber ZeroLock Esm H240

network securityransomwarethreat detection

ZeroLock Security: Automated Defense Against Linux Ransomware Threats

Written by Linux security expert and LinuxSecurity.com Founder Dave Wreski. Attacks in network security targeting Linux have surged in recent years due to the mass migration of workloads to the cloud and the increase in IoT and other connected devices on such networks. Traditional endpoint security solutions for Linux typically rely on the same algorithms and techniques developed to secure Windows desktops and don’t address the attack patterns unique to Linux. Therefore, such mitigation efforts are no longer sufficient to secure modern Linux workloads against today’s dynamic and evasive network security threats. . Luckily, solutions addressing Linux-specific challenges to fortify the most sophisticated and damaging network security issues exist. I have been quite impressed with a newer automated and efficient platform I’ve been using to detect and remediate threats on my Linux environment, Vali Cyber’s ZeroLock. In this article, I’ll examine the modern Linux threat landscape, introduce ZeroLock, and demonstrate how ZeroLock works to mitigate ransomware exploits in cybersecurity. The Modern Linux Threat Landscape in a Nutshell The popularity of Linux in recent years has put a target on the OS’s back. Linux malware reached an all-time high in the first half of 2022. The total number of cybersecurity vulnerabilities detected year-over-year shows that after Microsoft and Apple, Linux distros like RedHat and Debian have the highest numbers of network security issues reported. Traditional endpoint security solutions for Linux fail to address Linux-specific attack patterns, such as SSH exploits, cryptojacking, ransomware, and wiperware, which constantly evolve and can’t be identified by a simple file hash. Fileless attacks in network security are increasing against Linux systems, with over 50% of attacks now being fileless. This leverages cybersecurity vulnerabilities like log4J and others undetectable by file-based methodologies. Endpoint security attempts to protect targetedsystems by using high overhead, resource-intensive, version-specific methods, and complex kernel modules, ultimately leading to challenges in customer environments. In this complex and dynamic modern Linux threat environment, intelligent, automated solutions are required to secure Linux workloads against the increasingly evasive and dangerous network security threats targeting them. Experience the Power of ZeroLock’s Automated, Easy-to-Manage Protection I’m very impressed with how ZeroLock addresses the shortcomings of traditional Linux endpoint security agents to provide rapid detection of and remediation of various network security threats. ZeroLock meets Linux-specific challenges with automated lockdown configuration, sophisticated access control capabilities, and advanced behavioral threat detection technology. With ZeroLock, administrat ors can quickly and easily secure all of their Linux workloads against attacks in network security that would lead to compromise. Additionally, ZeroLock can detect any network security issues that breach the system so information can be recovered with minimal consumption of critical computing and human resources. ZeroLock taps into the heart of Linux to provide highly efficient, adequate protection. The solution intervenes in process creation and injects code into every new process, allowing it to monitor and control systems. This enables ZeroLock to defend against cloud security breaches that need access to the network, files, or other system resources via the Linux System Call Interface to be executed. ZeroLock intercepts all relevant system calls a process makes to examine and track them. Should a pattern of a process’s behavior be deemed suspicious, ZeroLock will intervene by either suspending or killing the process or caching file resources being attempted to be changed. This new hardening method enables ZeroLock to prevent more attacks than solutions that rely on traditional Linux hardening methods, detect any exploits in cybersecurity that getthrough by their behavior, and prevent or repair damage to files. ZeroLock’s distributed artificial intelligence and machine learning architecture is designed to support real-time detection and protection methodologies. Yet, it also helps you continually to learn from and adapt to the ever-changing malware analysis landscape. Vali Cyber has consolidated this intelligence into a constantly learning algorithm that operates in real-time to protect Linux workloads against file-based or fileless malware, ransomware attacks, and other malicious network security threats that target Linux today, with equally high efficacy regardless of the sophistication of the attack. If an attack does happen, ZeroLock remediates it promptly by copying all deleted or written files (encryption is considered a write operation) to a protected cache area. At the same time, the actions and process(es) involved are evaluated. This approach makes it possible to automatically restore compromised, deleted, or encrypted files by malicious code. The ZeroLock agent also has self-protection functionality that prevents malicious code from disabling or removing the agent from the system. Watch ZeroLock Mitigate a Ransomware Attack! ZeroLock uses behavioral markers to identify attacks in network security. It understands how individual types of ransomware and cryptojacking issues work and monitors for that behavior. ZeroLock focuses on specific network security threats (like RansomEXX and Log4j) and can discern a legitimate process for writing or deleting files from an actual ransomware attack. ZeroLock copies all deleted or written files to a special place in memory so that when network security issues take place, ZeroLock can recognize that attack, stop it in real-time, then restore any memory the files may have lost in deletions and encryptions so the system can go back to its normal trusted state. Maximum Security, Minimum Impact ZeroLock provides maximum Linux security with minimumimpact. It is clear that Vali Cyber recognizes that organizations today do not have a single monolithic OS across their entire infrastructure; therefore, they have engineered ZeroLock with this in mind. Running entirely in user space, ZeroLock does not require any kernel modules, is compatible with all Linux systems kernel version 3.5 or greater, and can reach across deployment environments (bare metal, VM, containers, cloud, and even embedded and IoT devices). This simplicity allows for streamlined deployment and uniformity of controls and protection. Administrators who deploy ZeroLock also enjoy the benefit of complete protection on workloads segmented from the Internet or air-gapped, and frequent updates are not required for ZeroLock’s behavior detection methods to remain secure. Final Thoughts on Defending Against Linux Ransomware As data and network security threats continue to evolve at an unprecedented rate, it is critical that defensive software keeps pace to meet new challenges. ZeroLock provides the type of intelligent, automated, and efficient protection necessary to fortify a modern Linux infrastructure against sophisticated network security issues like fileless malware and ransomware. Interested in learning more? Stay tuned for upcoming articles that will dive deeper into Log4j exploit prevention, securing WordPress sites on Linux, and more! . Strategies are available to address Linux vulnerabilities and reduce ransomware risks by effectively utilizing Vali Cyber's ZeroLock.. Linux Ransomware Protection, Network Threat Mitigation, Automated Security Solutions. . Brittany Day

Mar 06, 2023 •

Brittany Day

malwaresecurity solutionsphishing

Guardian Digital Email Solutions Against Phishing And Malware Threats

With email-related attacks becoming increasingly prevalent and serious, securing your business email accounts is more important than ever before. . With the wide selection of email security solutions that are currently available, selecting the best option may seem a bit overwhelming. If you are in the process of choosing a company to protect your email accounts from the latest and most serious threats, Guardian Digital , the open source email security company, hopes to make this choice a bit simpler by answering some frequently asked questions pertaining to email security and email-related attacks. Guardian Digital Answers Common Email Security Questions What components/characteristics should I look for when choosing an email security solution? How do these qualities make a solution effective at protecting against email-related threats? An effective email security solution recognizes that the email threat landscape is anything but stagnant, and that email-related threats are constantly evolving to become more targeted and sophisticated, making them increasingly difficult to detect. Technologies like Machine Learning, Big Data and heuristics techniques should be used to identify both new and known threats. It is crucial to choose an email security provider that adheres to the latest security standards, which include implementing the highest level of encryption to protect sensitive information from unauthorized parties. What are currently the most common and most serious email-related threats? How could these threats potentially affect my business? Phishing, malware, ransomware, and spam email are some of today’s most serious and most prevalent email-related threats. Phishing attacks can result in significant financial damage, and can be very difficult to detect and stop. Spam is another serious threat that impacts all email users, and can result in a significant decrease in worker productivity. Malware and ransomware attacks can have catastrophic consequences for organizations. SMBs are themost popular targets for ransomware attacks and 60% shut down within 6 months of an attack. (US National Cyber Security Alliance) Be Aware of Common Shortcomings in Anti-Phishing Defenses 40% of companies report that their email security falls short in protecting against phishing, and 13% have no system in place at all. What is a cloud email security solution and what role does it play in securing email accounts? A cloud email security solution is essential in protecting your email accounts from today’s dangerous array of email-related attacks and preventing data loss due to leakage of sensitive information. Guardian Digital EnGarde Cloud Email Security uses multi-layered detection and encryption to filter email and to secure private information from attackers and unauthorized parties. Guardian Digital’s cloud-based solution also provides additional email filtration that results in the highly accurate identification, quarantine and elimination of spam. What are the advantages of choosing Guardian Digital to secure my email accounts? Guardian Digital uses a purpose-built operating system that is designed to be highly secure, unlike many companies that take a “bolted-on” approach to security. The comprehensive, customizable security that Guardian Digital provides is multi-tiered and uses advanced security technologies coupled with expert, ongoing system management and support to protect your email from even the stealthiest attacks. For more information on Guardian Digital and the services we offer, please visit https://guardiandigital.com/ . If you have additional questions related to email security or email-related threats, please reach out to us on social media: Twitter | Facebook | LinkedIn . With the wide selection of email security solutions that are currently available, selecting the best. email-related, attacks, becoming, increasingly, prevalent, serious, securing, business, email. . Brittany Day

Jun 20, 2022 •

Brittany Day

cyber threatscybercrimeransomware

Insights on Cyber Threats and Defense from 'The Art of Cyberwarfare'

The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime , by Jon DiMaggio comes at a time in American History when everyone ranging from business owners to private citizens can no longer turn a blind eye to the need for cybersecurity.. Since the beginning of the COVID-19 pandemic, many businesses have moved to entirely remote or hybrid work and are now facing additional challenges from outside a traditional office environment. DiMaggio effectively captivates his audience to help them understand the major players in the ongoing cyberwar, the different methods attackers use, as well as how experts analyze attacks. Divided into two parts, the novel begins with the history and overview of cyberattacks and explores the geopolitical context in which these attacks occurred, as well as patterns discovered in attacker’s methods, and the supporting evidence analysts deemed responsible. In the second part of the book, Dimaggio details how defenses are able to track and assign future attacks, and provides the reader with techniques, tools, and the direction necessary for researching and dissecting the stages of attack campaigns. Regardless of your expertise level, this book is an insightful read whether you’re a member of a Security Operations Center team or an individual researcher. What separates The Art of Cyberwarfare from other novels on the subject are a drive for budding young professionals to have an expert resource leading them forward. Head over to the Guardian Digital Blog to read the full reveiw of The Art of Cyberwarfare . You can also download a sample chaper of The Art of Cyberwarfare from the Guardian Digital Resource Center. . In today's digital landscape, grasping cyber threats and establishing strong defenses is vital for businesses. 'The Art of Cyberwarfare' outlines key strategies for security.. Cybersecurity Strategies,Cyber Threat Analysis,Espionage Tactics,Cybercrime Prevention. . Justice Levine

Mar 27, 2022 •

Justice Levine

Community Poll

More Polls

Should Linux servers automatically install security updates?

Yes — critical security patches should install automatically.
No — every update should be tested before deployment.
Only critical vulnerabilities should auto-install.
I patch when Reddit starts panicking.

Stay Ahead With Linux Security Features

Refine features

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Cron Job Abuse For Linux Persistence Mechanisms Detection

Essential Cybersecurity Practices for Businesses to Protect Data

HTTP/2 Bomb: Why Linux Infrastructure is Vulnerable to a New Low-Bandwidth DoS Attack

Red Hat npm Package Compromise Highlights a Growing Supply Chain Problem

Explore Latest Linux Security features

BERT: Cross-Platform Ransomware Targeting Linux and ESXi Systems

Linux Ransomware Attack Breakdown: Strategies for Protection

Understanding Linux Ransomware Attack Steps and Protection Strategies

Strengthening WordPress Security on Linux: Key Strategies & Threats

IceFire Ransomware: Tactics, Protection, and Security Practices for Linux

ZeroLock Security: Automated Defense Against Linux Ransomware Threats

Guardian Digital Email Solutions Against Phishing And Malware Threats

Insights on Cyber Threats and Defense from 'The Art of Cyberwarfare'

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Cron Job Abuse For Linux Persistence Mechanisms Detection

Essential Cybersecurity Practices for Businesses to Protect Data

HTTP/2 Bomb: Why Linux Infrastructure is Vulnerable to a New Low-Bandwidth DoS Attack

Red Hat npm Package Compromise Highlights a Growing Supply Chain Problem

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!

Stay Ahead With Linux Security Features

Refine features

Topics

Category

Authors

Published Date

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Explore Latest Linux Security features

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Search Topics

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!