https://www.akamai.com/blog Akamai Security Intelligence and Threat Research Blog en Akamai Technologies https://www.akamai.com/blog/security/anatomy-of-a-syn-ack-attack Chad Seaman https://www.akamai.com/blog/security/anatomy-of-a-syn-ack-attack Tue, 01 Apr 2025 12:00:00 UTC The campaign was first seen by the Akamai SIRT on February 16, 2021, and appears to be targeting both Windows and Linux systems. The botnet caught our interest because it has shown to be highly active across a diverse set of geographical regions, including the Americas, Europe, and Asia. https://www.akamai.com/blog/security/kinsing-evolves-adds-windows-to-attack-list Evyatar Saias https://www.akamai.com/blog/security/kinsing-evolves-adds-windows-to-attack-list Thu, 16 Sep 2021 13:00:00 UTC Researching malware has many challenges. One of those challenges is obfuscated code and intentionally corrupted binaries. To address challenges like this, we've written a small tool in C that could fix intentionally corrupted binaries automatically. We also plan to open-source the project so other researchers could use it too, and perhaps improve and expand upon the tool's capabilities as needed. https://www.akamai.com/blog/security/upx-packed-headaches Akamai SIRT https://www.akamai.com/blog/security/upx-packed-headaches Mon, 23 Aug 2021 04:00:00 UTC HTTP Request Smuggling (also known as an HTTP Desync Attack) has experienced a resurgence in security research recently, thanks in large part to the outstanding work by security researcher James Kettle. His 2019 Blackhat presentation on HTTP Desync attacks exposed vulnerabilities with different implementations of the HTTP Standards, particularly within proxy servers and Content Delivery Networks (CDNs).These implementation differences with regard to how proxy servers interpret the construction of web requests have led to new request smuggling vulnerabilities. (Direct link to information on new vulnerability). https://www.akamai.com/blog/security/http-2-request-smuggling Ryan Barnett https://www.akamai.com/blog/security/http-2-request-smuggling Thu, 05 Aug 2021 04:00:00 UTC On July 2, 2021, Kaseya disclosed an active attack against customers using its VSA product, and urged all on-premise customers to switch-off Kaseya VSA. Shortly before this alert, users on Reddit started describing ransomware incidents against managed security providers (MSPs), and the common thread among them was on-premise VSA deployments. In the hours to follow, several indicators of compromise (IOCs) were released, and Akamai was able to observe some of that traffic. A patch for the VSA product was released by Kaseya on July 11. https://www.akamai.com/blog/security/kaseya-supply-chain-ransomware-attack Ryan Barnett https://www.akamai.com/blog/security/kaseya-supply-chain-ransomware-attack Thu, 15 Jul 2021 04:00:00 UTC https://www.akamai.com/blog/security/thinkphp-exploit-actively-exploited-in-the-wild Larry Cashdollar https://www.akamai.com/blog/security/thinkphp-exploit-actively-exploited-in-the-wild Wed, 26 May 2021 04:00:00 UTC Recent attacks against Akamai customers have leveraged a networking protocol known as protocol 33, or Datagram Congestion Control Protocol (DCCP). https://www.akamai.com/blog/security/threat-advisory-dccp-for-ddos Chad Seaman https://www.akamai.com/blog/security/threat-advisory-dccp-for-ddos Tue, 23 Mar 2021 04:00:00 UTC There are many crypto mining malware variants infecting systems on the internet. On Friday, March 4, 2021, I noticed an interesting hit in my honeypot logs. The binary it captured stood out, as it was rather large at 4MB. I immediately thought it would be a crypto miner written in the Go language. I was correct. This one however, has some newer exploits it's using for proliferation. https://www.akamai.com/blog/security/another-golang-crypto-miner-on-the-loose Larry Cashdollar https://www.akamai.com/blog/security/another-golang-crypto-miner-on-the-loose Tue, 16 Mar 2021 04:00:00 UTC A recent piece of malware from a known crypto mining botnet campaign has started leveraging Bitcoin blockchain transactions in order to hide its backup C2 IP address. It's a simple, yet effective, way to defeat takedown attempts. https://www.akamai.com/blog/security/bitcoins--blockchains--and-botnets Evyatar Saias https://www.akamai.com/blog/security/bitcoins--blockchains--and-botnets Tue, 23 Feb 2021 05:00:00 UTC On 14 July, 2020, Oliver Hough, a security researcher from Cyjax, published a report centered on a phishing campaign targeting banking customers in the United Kingdom, which evades two-factor authentication (2FA). https://www.akamai.com/blog/security/massive-campaign-targeting-uk-banks-bypassing-2fa Or Katz https://www.akamai.com/blog/security/massive-campaign-targeting-uk-banks-bypassing-2fa Thu, 18 Feb 2021 05:00:00 UTC During the COVID-19 pandemic, I wanted to extend the local WiFi in my home to reach all the floors. The goal was to have full connectivity from every location in the house. https://www.akamai.com/blog/security/command-injection-on-a-d-link-router Assaf Vilmovski https://www.akamai.com/blog/security/command-injection-on-a-d-link-router Tue, 09 Feb 2021 05:00:00 UTC When we write the SOTI and talk about attacks against gamers, we spend a good deal of time focusing on network-level events, such as DDoS and credential stuffing. https://www.akamai.com/blog/security/minecraft-players-are-targets-even-off-the-network Steve Ragan https://www.akamai.com/blog/security/minecraft-players-are-targets-even-off-the-network Tue, 26 Jan 2021 05:00:00 UTC The Novel Coronavirus, and the resulting viral respiratory illness caused by it, COVID-19, is changing our world. As much as possible, people around the world are practicing social distancing. This means working remotely for a large number of people, possibly... https://www.akamai.com/blog/security/the-building-wave-of-internet-traffic Martin McKeay https://www.akamai.com/blog/security/the-building-wave-of-internet-traffic Mon, 13 Apr 2020 04:00:00 UTC A group calling themselves "Cozy Bear" has been emailing various companies with an extortion letter, demanding payment and threatening targeted DDoS attacks if their demands are not met.... https://www.akamai.com/blog/security/fake-cozy-bear-group-making-ddos-extortion-demands Akamai SIRT https://www.akamai.com/blog/security/fake-cozy-bear-group-making-ddos-extortion-demands Fri, 15 Nov 2019 05:00:00 UTC I have been playing close attention to Internet of Things (IoT) malware targeting systems with Telnet enabled, while also collecting samples targeting systems with SSH enabled on port 22. I've collected over 650 samples landing in my honeypot within the... https://www.akamai.com/blog/security/xmr-cryptomining-targeting-x86i686-systems Larry Cashdollar https://www.akamai.com/blog/security/xmr-cryptomining-targeting-x86i686-systems Fri, 30 Aug 2019 04:00:00 UTC On Tuesday, August 13th at 10 AM Pacific Time (1700UTC), Netflix publicly disclosed a series of vulnerabilities found by Jonathan Looney that impact many implementations of the HTTP2 protocol. A vulnerability found by Piotr Sikora of Google was also released... https://www.akamai.com/blog/security/http2-vulnerabilities Akamai https://www.akamai.com/blog/security/http2-vulnerabilities Tue, 13 Aug 2019 04:00:00 UTC In June 2019, logs on my personal website recorded markers that were clearly Remote File Inclusion (RFI) vulnerability attempts. The investigation into the attempts uncovered a campaign of targeted RFI attacks that currently are being leveraged to deploy phishing kits.... https://www.akamai.com/blog/security/criminals-using-targeted-remote-file-inclusion-attacks-in-phishing-campaigns Larry Cashdollar https://www.akamai.com/blog/security/criminals-using-targeted-remote-file-inclusion-attacks-in-phishing-campaigns Mon, 29 Jul 2019 04:00:00 UTC https://www.akamai.com/blog/security/cloudtest-vulnerability-cve-2019-11011 Akamai InfoSec https://www.akamai.com/blog/security/cloudtest-vulnerability-cve-2019-11011 Sun, 16 Jun 2019 04:00:00 UTC Phishing is a multifaceted type of attack, aimed at collecting usernames and passwords, personal information, or sometimes both. Yet, these attacks only work so long as the phishing kit itself remains hidden. Phishing is a numbers game and time is... https://www.akamai.com/blog/security/catch-me-if-you-can-evasive-and-defensive-techniques-in-phishing Or Katz https://www.akamai.com/blog/security/catch-me-if-you-can-evasive-and-defensive-techniques-in-phishing Wed, 12 Jun 2019 04:00:00 UTC Researchers at Akamai observed attackers using a novel approach for evading detection. This new technique - which we call Cipher Stunting - has become a growing threat, with its roots tracing back to early-2018. By using advanced methods, attackers are... https://www.akamai.com/blog/security/bots-tampering-with-tls-to-avoid-detection Akamai Threat Research Team https://www.akamai.com/blog/security/bots-tampering-with-tls-to-avoid-detection Wed, 15 May 2019 04:00:00 UTC When it comes to phishing, criminals put a lot of effort into making their attacks look legitimate, while putting pressure on their victims to take action. In today's post, we're going to examine a recent phishing attempt against me personally.... https://www.akamai.com/blog/security/phishing-attacks-against-facebook-google-via-google-translate Larry Cashdollar https://www.akamai.com/blog/security/phishing-attacks-against-facebook-google-via-google-translate Tue, 05 Feb 2019 05:00:00 UTC