Introduction to NSFOCUS WAF SNMP
December 22, 2023
Simple Network Management Protocol (SNMP) is an application-layer protocol that transmits management data between network devices. SNMP belongs to the Transmission Control Protocol/Internet Protocol (TCP/IP) family and is one of the most widely used network protocols for managing and monitoring network components across a variety of industries. The majority of network components come with an […]
NSFOCUS Recognized as One of Representative SOAR Vendors in Frost & Sullivan’s Report
December 21, 2023
SANTA CLARA, Calif., Dec 21, 2023 – NSFOCUS proudly announces its recognition in Frost & Sullivan’s latest report Insights for CISOs: Modernizing Security Operations Centers with Security Orchestration and Automated Response as a representative vendor. This insightful report delves into the growth environment, enterprise application value, SOAR solution benefits, the vendor ecosystem, and growth opportunities […]
xorbot: A Stealthy Botnet Family That Defies Detection
December 18, 2023
I. Background of xorbot In November 2023, NSFOCUS Global Threat Hunting System detected that a type of elf file was being widely distributed and accompanied by a large amount of suspected encrypted outbound communication traffic. However, the detection rate of mainstream antivirus engines on this file was close to zero, which aroused our curiosity. After further […]
Hong Kong Cybersecurity Symposium 2023
December 15, 2023
Cybersecurity Symposium 2023, Dec 14, Convention Hall @Hong Kong Convention and Exhibition Centre, Hong Kong The Cybersecurity Symposium is co-organised by the Office of the Government Chief Information Officer (OGCIO) and Hong Kong Internet Registration Corporation Limited (HKIRC). It aims to unite quangos, enterprises and other local organizations in Hong Kong to address the cybersecurity challenges of the digital […]
Interpretation of Guidelines for Secure AI System Development
December 11, 2023
Introduction On November 26, 2023, the Guidelines for secure AI system development was jointly released by the UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the US National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and the cybersecurity and information security departments of over […]
Differences between NTA Auto IP Diversion and Auto Group Diversion
December 8, 2023
You may have seen that there are two diversion modes in NTA alerts. They are Auto IP diversion and Auto group diversion. The Auto group diversion is triggered by the Region/IP Group Traffic Alert (at step 3 when configuring Regions or IP Groups). The Auto IP diversion is triggered by the Region/IP Group DDoS Attack […]
The Imperative for Zero Trust in a Cloud-Native Environment
December 7, 2023
What is Zero Trust Security? Zero-trust security is not a specific technology or product, but a security model based on the concept that “All entities are untrusted”. Forrester defines zero trust as “Zero Trust is an information security model that denies access to applications and data by default. Threat prevention is achieved by only granting […]
CDIC 2023
December 2, 2023
CDIC, Nov 29-30, 2023, BITEC Bangna, Thailand. The CDIC conference & exhibition was held with the theme of “Powering Techno-Drive in Digi-Hype Behaviour towards Digital Trust”. NSFOCUS participated this pivotal event as Gold Sponsor in APAC to introduce our latest effective continuous threat exposure management (CTEM) program and XDR-powered threat analysis and response. “Cyber Defense Initiative Conference […]
Prepare, Prevent, and Response: A Comprehensive Ransomware Protection Guide
December 1, 2023
Rampant Ransomware Attacks On November 8, 2023, U.S. Eastern Time, ICBC Financial Services (FS), the U.S. arm of China’s largest bank, fell victim to a ransomware attack, disrupting certain systems. Reports indicate that the attack, linked to a Citrix vulnerability known as “CitrixBleed,” was orchestrated by the LockBit group. ICBC FS is actively investigating the […]
Apache ActiveMQ Jolokia Remote Code Execution Vulnerability (CVE-2022-41678) Notification
November 30, 2023
Overview Recently, NSFOCUS CERT found a remote code execution vulnerability in Apache ActiveMQ Jolokia (CVE-2022-41678). In the configuration of ActiveMQ, jetty allows org.holokia.http.AgentServlet to process requests for/api/Jolokia. An authenticated attacker can send a specially crafted HTTP request to write a malicious file through the Jolokia service, thus implementing remote code execution. At present, the vulnerability […]
