Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges
Security Vulnerabilities 
security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Security Trends cybersecurity Linux documentation
cybersecurity Linux documentation Linux operating systems have gained prominence due to their stability, adaptability, and excellent security options. In the case of developing documentation, designing cybersecurity dashboards, or educational material, visuals are of vital importance when it comes to making things clear. The use of icons allows one to understand the message regarding alerts, authorization, encryption, authentication, or the state of the system just by looking at the visual cue without having to read long...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 26 articles for you...
83
security advisoryrootkitbrute forceCentOS 7: TeamTNT Attack Advisory moderate: Brute Force Total Compromise
Security researchers have recently observed an alarming resurgence of TeamTNT , a notorious hacking group known for targeting cloud infrastructures. Their latest campaign zeroes in on Virtual Private Server (VPS) environments running CentOS, particularly version 7. . On a broader scale, this threat highlights the growing complexity of securing cloud infrastructure and the risks associated with running outdated systems like CentOS 7. To help you better understand and proactively address this emerging threat, I'll discuss the nature of these attacks, what makes CentOS 7 an attractive attack target, and practical steps Linux admins and organizations can take to mitigate risk. The Anatomy of the Attack TeamTNT's attack methodology has evolved over the years, making it a significant threat to cloud infrastructures. The latest campaign begins with a Secure Shell (SSH) brute force attack on the target's assets. Once access is gained, a malicious script is uploaded, which initiates a series of harmful actions to compromise the server's security. The script is multifaceted, involving the following tactics and steps: Disable Security Features: It starts by disabling the existing security mechanisms to avoid detection. Log Deletion & System Modification: It deletes logs and modifies crucial system files to cover its tracks. Crypto Miner Killer: The script searches for and kills existing cryptocurrency mining processes, ensuring that TeamTNT can monopolize the system's resources. DNS Setting Changes: DNS settings are altered to Google’s servers, possibly to bypass existing security filters. Rootkit Installation: The script installs the Diamorphine rootkit , a loadable kernel module that covertly allows the attacker to execute malicious activities. Backdoor Creation: It also creates a backdoor user with root access and installs a public key for secure access. The Diamorphine rootkit provides covert capabilities such as silent execution, hiding processes,and allowing the attacker to gain root access at will. Additionally, the script further locks down the system by modifying file attributes, making it difficult for administrators to unlock and recover protected files. Why Is CentOS 7 Particularly Vulnerable? CentOS 7, while widely used, is particularly vulnerable for several reasons: Discontinued Support: Although still prevalent, CentOS 7 no longer receives regular updates and security patches, making these systems an easy target for attackers. Older Kernel Vulnerabilities: CentOS 7 runs on older Linux kernel versions, which may contain vulnerabilities that have been patched in later releases. Usage in Cloud Environments: CentOS 7 is commonly used in VPS and cloud environments, making it an attractive target for cryptojacking and other resource-intensive attacks. These inherent vulnerabilities and often lax security practices in cloud setups make CentOS 7 an ideal target for TeamTNT's malicious campaigns. TeamTNT's Resurgence Highlights The Growing Complexity of Securing Cloud Infrastructures The resurgence of TeamTNT underscores a broader trend: the increasing complexity of securing cloud environments. The attack surface has significantly expanded with the rapid adoption of cloud-native technologies like Kubernetes and Docker. Sophisticated threat actors can easily exploit misconfigurations and weak security practices. As cloud deployments become more complex, so do threat actors' tactics, requiring organizations to evolve their security measures continually. Practical Mitigation Strategies for Admins & Organizations To protect against these sophisticated attacks, Linux administrators must adopt a multi-layered security approach. Here are some specific and practical steps they can implement: Strengthen SSH Configurations: Use strong, unique passwords or SSH keys for authentication. Disable root login via SSH and create a separate user with sudo privileges. Implement rate limiting and intrusion detectiontools like Fail2Ban to thwart brute force attacks. Regular Updates and Patch Management: Update your OS regularly and apply the latest security patches . For CentOS 7, consider using community-supported repositories for essential updates. Kernel Hardening: Use module signing and disable loadable kernel modules unless necessary. Implement kernel hardening measures like SELinux or AppArmor. Monitor for Rootkits: Employ rootkit detection tools like chkrootkit and rkhunter . Regularly check for unusual system behaviors that could indicate rootkit installation. Secure Containerized Environments: Ensure Docker and Kubernetes configurations follow security best practices. This includes setting resource limits, network segmentation, and enabling role-based access control. Firewall Configuration: Set firewalls to allow only essential services and restrict SSH access to a select set of IP addresses. Enhanced Security Measures: Utilize security tools that rapidly detect and respond to advanced threats. Security Information and Event Management (SIEM) solutions and Intrusion Detection Systems (IDS) can mitigate risks before they escalate. Our Final Thoughts on This Emerging Linux Security Threat The resurgence of TeamTNT serves as a stark reminder of the growing threats to cloud infrastructures. While CentOS 7 remains a popular choice for VPS, its discontinuation and associated vulnerabilities make it an attractive target for sophisticated cybercriminals. By implementing robust security practices, regularly updating systems, and continuously monitoring for threats, Linux administrators can significantly mitigate the risks posed by groups like TeamTNT. Securing cloud environments is an ongoing battle, but organizations can stay one step ahead of malicious actors with the right strategies and tools in place. . Analyzes the emergence of TeamTNT as a formidable menace targeting CentOS VPS, focusing on their tactics, exploited weaknesses, and countermeasures for Linuxsystem administrators.. TeamTNT Threats, Securing CentOS 7, VPS Security Best Practices, Linux Attack Mitigation, Cloud Security Challenges. . Anthony Pell
Sep 23, 2024
•
Hacks/Cracks
77
malwareremote managementLinuxTsunami Botnet Targets Linux SSH Servers: Malicious Brute Force Attacks
An unknown threat actor is brute-forcing Linux SSH servers to install a wide range of malware, including the Tsunami DDoS (distributed denial of service) bot, ShellBot, log cleaners, privilege escalation tools, and an XMRig (Monero) coin miner. . SSH (Secure Socket Shell) is an encrypted network communication protocol for logging into remote machines, supporting tunneling, TCP port forwarding, file transfers, etc. Network administrators typically use SSH to manage Linux devices remotely, performing tasks such as running commands, changing the configuration, updating software, and troubleshooting problems. However, if those servers are poorly secured, they might be vulnerable to brute force attacks , allowing threat actors to try out many potential username-password combinations until a match is found. . The Tsunami botnet malware specifically aims at inadequately protected Linux SSH servers, leveraging numerous vulnerabilities.. Linux Malware, SSH Security, Brute Force Attacks, Tsunami Botnet, Remote Server Management. . LinuxSecurity.com Team
Jun 26, 2023
•
Server Security
83
linux applicationsenterprise softwarecyber threatAnalyzing DreamBus Botnet Threats Against Linux Enterprise Systems
The recently discovered DreamBus botnet uses exploits and brute-force attacks to target PostgreSQL, Redis, SaltStack, Hadoop, Spark, and others enterprise-level apps that run on Linux systems. "The idea is to give the DreamBus gang a foothold on a Linux server where they could later download and install an open-source app that mines the Monero (XMR) cryptocurrency to generate profits for the attackers." . Chances are that if you deploy a Linux server online these days and you leave even the tiniest weakness exposed, a cybercrime group will ensnare it as part of its botnet. The latest of these threats is named DreamBus. Analyzed in a report published last week by security firm Zscaler, the company said this new threat is a variant of an older botnet named SystemdMiner, first seen in early 2019 . . Should you launch a Linux server in the cloud today and overlook any minor weakness, hackers will take advantage of it.. DreamBus Botnet, Linux Applications, Security Threat, Cryptocurrency Mining, Open Source Security. . LinuxSecurity.com Team
Jan 25, 2021
•
Hacks/Cracks
77
malwarecyber attacksecurity threatGoldBrute Botnet Escalates Attacks On RDP Servers Worldwide
Security researchers have discovered an ongoing sophisticated botnet campaign that is currently brute-forcing more than 1.5 million publicly accessible Windows RDP servers on the Internet. . Dubbed GoldBrute, the botnet scheme has been designed in a way to escalate gradually by adding every new cracked system to its network, forcing them to further find new available RDP servers and then brute force them. To fly under the radar of security tools and malware analysts, attackers behind this campaign command each infected machine to target millions of servers with a unique set of username and password combination so that a targeted server receives brute force attempts from different IP addresses. . Dubbed GoldBrute, the botnet scheme has been designed in a way to escalate gradually by adding every. security, researchers, ongoing, sophisticated, botnet, campaign, currently. . LinuxSecurity.com Team
Jun 07, 2019
•
Server Security
79
brute forcepenetration testingPython toolDiscover Patator: The Multi-Purpose Python Brute Force Tool
Patator is an extremely flexible, module, multi-threaded, multi-purpose service & URL brute forcing tool written in Python that can be used in many ways. Basically the author got tired of using Medusa, Hydra, ncrack, metasploit auxiliary modules, nmap NSE scripts and the like because:. They either do not work or are not reliable (got me false negatives several times in the past) They are not flexible enough (how to iterate over all wordlists, fuzz any module parameter) They lack useful features (display progress or pause during execution) The link for this article located at darknet UK is no longer available. . Dive into Patator, an adaptable and multi-threaded brute-force tool crafted for exploiting a range of services.. Patator, Multi-Threaded Tool, Brute Force Techniques. . LinuxSecurity.com Team
Jun 10, 2015
•
Security Projects
83
security advisorymalwarecyber threatNew Linux Backdoor Subverts Systems For DDoS: Brute Force Attack
Cybercrooks have cooked up a Linux backdoor boasting multiple malicious functions. The Swiss Army Knife-style malware . To spread the new Linux backdoor, criminals mount a brute force attack to establish an SSL connection with a target machine. The link for this article located at The Register UK is no longer available. . A recently discovered Linux vulnerability enables hackers to exploit machines for DDoS attacks by leveraging brute force SSL connection methods.. Linux Backdoor, DDoS Attack, Cyber Threat, Brute Force Attack, Malware Distribution. . LinuxSecurity.com Team
Feb 10, 2015
•
Hacks/Cracks
83
security advisorycritical infrastructurepassword issuePublic Utility Breach: DHS Report Confirms Critical Password Flaw
A public utility in the U.S. was compromised after attackers took advantage of a weak password security system, according to a U.S. Department of Homeland Security team that studies cyberattacks against critical infrastructure. . The utility's control system was accessible via Internet-facing hosts and used a simple password system, wrote the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) in a report on incidents covering the first quarter of this year. The link for this article located at Network World is no longer available. . The utility's control system was accessible via Internet-facing hosts and used a simple password sys. public, utility, compromised, attackers, advantage, password, secur. . LinuxSecurity.com Team
May 21, 2014
•
Hacks/Cracks
67
authenticationcompromiseSSHPreventing SSH Brute Force Attacks and Strengthening Weak Passwords
One common and stupidly simple way hosts are compromissed is weak SSH passwords. You would think people have learned by now, but evidently there are still enough systems with root passwords like 12345 around to make scanning for them a worthwhile exercise. . As a result, one of my favorite honeypot tools is kippo, and we have talked about the tool before. I figured it is a good time again to write a quick update on some recent compromisses. Unauthorized access attempts via SSH expose vulnerabilities in password strength, underscoring the importance of implementing robust authentication techniques.. SSH Attacks, Password Strength, Brute Force Protection. . LinuxSecurity.com Team
Jul 26, 2013
•
Cryptography
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!