RSA Among Dozens of Firms Breached by Zero-Day Attacks
Summary: Attackers who breached RSA used the same three domains - Good[DOT]mincesur[DOT]com, up82673[DOT]hopto[DOT]org and www[DOT]cz88[DOT]net - to infiltrate dozens of other companies over at least a 12-month period before the RSA disclosure, according to Damballa, which monitored DNS traffic between those hostile domains and dozens of Fortune 500 companies. RSA said attackers stole information related to its SecurID two-factor authentication products, and the intruders moved their operations from those sites after US-CERT published their locations.
Key Takeaway: Damballa's Gunter Ollmann said the malicious domains were known for a very long time and 'there is no excuse for organizations not blocking [access to] those sites' - yet dozens of companies, including firms that sell Internet security services, kept talking to them.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026