<img alt="" src="https://lh6.googleusercontent.com/l--wjKsSMUVFpP4_9raUZAgKO_iRyav6eW4w05fuXUvEQLKdmik8BW1N2GE6CAS4zPJwufiPdonDr88BKzT0LyteMuVNTAnM9SEa2Yx8LOC3bA7br0jkHKuwISz5To6qVGDFnE60=s0" />

The Uptycs threat research group warns of a new botnet called The Simps. Its creation is credited to the criminal group Keksec, which specializes in DDoS attacks.

The Uptycs threat research group warns of a new botnet called The Simps created by the criminal group Keksec specializing in DDoS attacks.

The Simps: a New Botnet, 2021 | StormWall

20 july 2021

<h1>Keksec Cybergang Debuts Simps Botnet for Gaming DDoS</h1>

The Uptycs threat research group warns of a new botnet called The Simps. Its creation is credited to the criminal group Keksec, which specializes in DDoS attacks. According to the researchers, the Gafgyt botnet has become a kind of &quot;base&quot; for the deployment of the Simps malicious code.

The first infections began in April. Gafgyt (also known as Bashlite) is a Linux-based botnet first discovered in 2014. It targets vulnerable IoT devices such as Huawei routers, Realtek routers and ASUS devices, which it then uses to launch large-scale DDoS attacks. The malware has recently added new functionality for using exploits to hack devices.

Thanks to links to chat on Discord and Telegram, experts attribute the creation of the Simps to the Keksec group (also known as Kek Security), which is a vast group of threats known for exploiting vulnerabilities to invade multiple architectures using polymorphic tools (running on different platforms and operating systems).

<img alt="" src="https://lh6.googleusercontent.com/l--wjKsSMUVFpP4_9raUZAgKO_iRyav6eW4w05fuXUvEQLKdmik8BW1N2GE6CAS4zPJwufiPdonDr88BKzT0LyteMuVNTAnM9SEa2Yx8LOC3bA7br0jkHKuwISz5To6qVGDFnE60=s0" />

In this regard, corporate users and network administrators are advised to:

<ul>
	<li>Regularly monitor suspicious processes, events and network traffic that occur when executing any unreliable or suspicious scripts;</li>
	<li>Be wary of external scripts;</li>
	<li>Update systems and firmware of all network devices to the latest releases and versions.</li>
</ul>

Keksec Cybergang Debuts Simps Botnet for Gaming DDoS

<img alt="" src="https://lh3.googleusercontent.com/UFYsUqB1DhD-C4qCzzprVKoHb1o4obNJ7fDR-RjsBzDMb8klXde0iUufCjARwR_5JhHu2s72Du96s4tGcbScaalTRDRi57GenI5cUly90upkZrtxadIyMlu2Zn0nwn9pjjoE751m" />

Network security experts have found an increase in attacks using Session Traversal Utilities for NAT (STUN). How to protect yourself?

STUN servers are vulnerable only when they work over UDP. If network administrators configure STUN to run over TCP only, the exploit can be avoided.

Protection Against DDoS Based on STUN Exploit | StormWall

13&nbsp;july 2021

<h1>STUN Servers increasingly abused for DDoS attacks</h1>

<h2>STUN vulnerability resume</h2>

Network security experts have found an increase in attacks using Session Traversal Utilities for NAT (STUN).

STUN servers are needed on the network so that devices connected to the Internet &ldquo;know&rdquo; their external IP address. This is necessary for the correct &quot;communication&quot; of the computer with other resources on the Internet. However, the overwhelming majority of devices are connected to the Internet through a gateway in a local network with a NAT screen (in simple words, through a router that issues local network IP addresses to computers, not &ldquo;external&rdquo; IP addresses).

At this stage, the STUN server comes into play: a computer from the local network sends a packet to the STUN server, which receives it and sends it back, &ldquo;signing&rdquo; the packet with the address and port number from which it received it. As soon as the computer receives the signed packet, it &ldquo;learns&rdquo; its external ip and gateway address and will be able to &ldquo;communicate&rdquo; with other resources on the Internet. According to a press release from Netscout, the new attacks exploit vulnerable systems running STUN services and allow attackers to launch UDP reflection / amplification attacks against their chosen target. Today, there are more than 75 thousand vulnerable servers on the network, the number of requests from which during an attack can be increased up to 3 times and direct the victim&#39;s IT infrastructure. The ubiquity of vulnerable STUN servers and the traffic amplification they achieve make STUN a challenge for any organization. IT security professionals make the following topical recommendations in this regard.

<img alt="" src="https://lh3.googleusercontent.com/UFYsUqB1DhD-C4qCzzprVKoHb1o4obNJ7fDR-RjsBzDMb8klXde0iUufCjARwR_5JhHu2s72Du96s4tGcbScaalTRDRi57GenI5cUly90upkZrtxadIyMlu2Zn0nwn9pjjoE751m" />

<h2>How to protect against DDoS based on STUN exploit?</h2>

<ul>
	<li>STUN servers are vulnerable only when they work over UDP. If network administrators configure STUN to run over TCP only, the exploit can be avoided;</li>
	<li>Network administrators must quickly implement best practices for building and securing networks in their operations to meet the most pressing IT threats;</li>
	<li>It is recommended to separate the internal traffic of the organization (intranet) from the external one. You should be able to pass traffic from the outside, including through the backup connection channel. In this case, the activities of the back office will not suffer from a large-scale attack from the external network, and if it does happen, then there will be a backup channel of communication with the &ldquo;outside world&rdquo;</li>
	<li>IT infrastructure must be protected by specialized services against DDoS attacks. On-premises DDoS protection services should be combined with cloud or transit DDoS protection services for maximum responsiveness and flexibility during an attack.</li>
</ul>

STUN Servers increasingly abused for DDoS attacks

<img alt="" src="https://lh6.googleusercontent.com/LTfbzdCCucs3QK63kdFw4f5esQTGm1qjlBYPBoBOhgxw22gJTkWQMmeXhO8wgVYeC-kkiA-qkQsDngA6qtb1kclyZrZxi067af-IxWBOJF84T4u_KOBEy3y98ZcVxKSCP4UwgcMR=s0" />

Most companies tend to underestimate DDoS attacks and the threats they pose. Every year the attacks become more dangerous and sophisticated; their power is continuously growing.

Why it is not profitable to organize DDoS protection in-house and what the advantages of professional Anti-DDoS solutions

Top Reasons to Use Professional Anti-DDoS Solutions | StormWall

23 july 2021

<h1>5 Reasons to Get a Professional Protection From DDoS Attack</h1>

Most companies tend to underestimate DDoS attacks and the threats they pose. Every year the attacks become more dangerous and sophisticated; their power is continuously growing. Fighting DDoS attacks is an extremely challenging task. Some companies try to organize the protection of their resources internally, while others use professional Anti-DDoS solutions and find themselves in a more advantageous situation.

<ul>
	<li>Expertise that can&rsquo;t be achieved in-house unless you are a tech company</li>
</ul>

Modern DDoS-protection is very cost-intensive: IT specialists are very expensive employees, and you also need modern software and hardware installed globally to have any chances to withstand brutal yet ubiquitous DDoS-attacks on your company.

<img alt="" src="https://lh6.googleusercontent.com/LTfbzdCCucs3QK63kdFw4f5esQTGm1qjlBYPBoBOhgxw22gJTkWQMmeXhO8wgVYeC-kkiA-qkQsDngA6qtb1kclyZrZxi067af-IxWBOJF84T4u_KOBEy3y98ZcVxKSCP4UwgcMR=s0" />

<ul>
	<li>Constantly up-to-date:</li>
</ul>

your security system should contain the latest fixes and updates so that it is efficient. You are not safe unless your security keeps up with the ongoing evolution of cyber threats

<ul>
	<li>Expert support and tailored approach:</li>
</ul>

there is no standard solution for a security system of an organization. It all depends on your IT architecture: how frequently you connect to third parties, whether you use cloud solutions etc&hellip;

<ul>
	<li>Economy of scale:&nbsp;</li>
</ul>

DDoS security services operate numerous servers all over the world which make up a global mitigation network. One company won&rsquo;t be able to afford such a network, whereas DDoS protection services use the same mitigation network to protect various clients, thus dividing the network&rsquo;s operational costs between the clients.

<ul>
	<li>Innovative approach:</li>
</ul>

State of the art DDoS protection services use sophisticated machine learning algorithms to monitor and filter incoming traffic. This is only one particular result of an ongoing research and development process fostered by the IT security companies. No e-commerce company or online service can invest in such research on their own; that&rsquo;s why it is quite logical to use third-party DDoS-protection services.

Keksec Cybergang Debuts Simps Botnet for Gaming DDoS

Read also articles: