<rss version="2.0"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:media="http://search.yahoo.com/mrss/">
    <channel><title>Bitdefender Labs</title><description>Daily source of cyber-threat information. Established 2001.</description><link>https://www.bitdefender.com/en-gb/blog/labs/</link><image><url>https://download.bitdefender.com/resources/images/favicon/favicon-32x32.png</url><title>Bitdefender Labs</title><link>https://www.bitdefender.com/en-gb/blog/labs/</link></image><generator>Bitdefender Blog</generator><lastBuildDate>Fri, 01 May 2026 16:08:49 GMT</lastBuildDate><atom:link href="https://www.bitdefender.com/nuxt/api/en-gb/rss/labs/whitepapers/" rel="self" type="application/rss+xml"/><ttl>1800</ttl><item><title>Vulnerabilities Identified in Dahua Hero C1 Smart Cameras</title><description><![CDATA[Researchers at Bitdefender have identified critical security vulnerabilities in the firmware of the Dahua Hero C1 (DH-H4C) smart camera series. The flaws, affecting the device's ONVIF protocol and file upload handlers, allow unauthenticated attackers to execute arbitrary commands remotely, effectively taking over the device.

The vulnerabilities were reported to Dahua for responsible mitigation and disclosure and are now patched at the time of publication.


Affected Devices

The issues were ver]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/vulnerabilities-identified-in-dahua-hero-c1-smart-cameras</link><guid isPermaLink="false">688a2c7495161a04e7e9533a</guid><category><![CDATA[Whitepapers]]></category><category><![CDATA[IoT Research]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 30 Jul 2025 14:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2025/07/Technology_Background_-_Digital_Hand_Unlocking_Portal-1.jpg" medium="image"/><content:encoded><![CDATA[Researchers at Bitdefender have identified critical security vulnerabilities in the firmware of the Dahua Hero C1 (DH-H4C) smart camera series. The flaws, affecting the device's ONVIF protocol and file upload handlers, allow unauthenticated attackers to execute arbitrary commands remotely, effectively taking over the device.

The vulnerabilities were reported to Dahua for responsible mitigation and disclosure and are now patched at the time of publication.


Affected Devices

The issues were ver]]></content:encoded></item><item><title>60 Hurts per Second – How We Got Access to Enough Solar Power to Run the United States</title><description><![CDATA[The electricity grid – the buzzing, crackling marvel that supplies the lifeblood of modernity - is by far the largest structure humanity ever built. It’s so big, in fact, that few people even notice it, like a fish can’t see the ocean.

Until the grid goes down, that is. Then, like the fish dangling from the angler’s hook, we see our vulnerability. Modernity dissolves into a sudden silence, followed by the repeated flick of a light switch, and a howl of panic at the prospect of missed appointmen]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/60-hurts-per-second-how-we-got-access-to-enough-solar-power-to-run-the-united-states</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722d2</guid><category><![CDATA[IoT Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Ioan Alexandru MELNICIUC</dc:creator><pubDate>Wed, 07 Aug 2024 13:16:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2024/08/1ZZ96uESRJQ.jpg" medium="image"/><content:encoded><![CDATA[The electricity grid – the buzzing, crackling marvel that supplies the lifeblood of modernity - is by far the largest structure humanity ever built. It’s so big, in fact, that few people even notice it, like a fish can’t see the ocean.

Until the grid goes down, that is. Then, like the fish dangling from the angler’s hook, we see our vulnerability. Modernity dissolves into a sudden silence, followed by the repeated flick of a light switch, and a howl of panic at the prospect of missed appointmen]]></content:encoded></item><item><title>Unfading Sea Haze: New Espionage Campaign in the South China Sea</title><description><![CDATA[Bitdefender researchers investigated a series of incidents at high-level organizations in countries of the South China Sea region, all performed by the same  threat actor we track as Unfading Sea Haze. Based on the victimology and the cyber-attack’s aim, we believe the threat actor is aligned with China’s interests.
As tensions in the region rise, they are reflected in the intensification of activity on behalf of the Unfading Sea Haze actor, which uses new and improved tools and TTPs.

We notice]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/unfading-sea-haze-new-espionage-campaign-in-the-south-china-sea</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722d0</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 22 May 2024 14:45:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2024/05/diver-1850255_1920.jpg" medium="image"/><content:encoded><![CDATA[Bitdefender researchers investigated a series of incidents at high-level organizations in countries of the South China Sea region, all performed by the same  threat actor we track as Unfading Sea Haze. Based on the victimology and the cyber-attack’s aim, we believe the threat actor is aligned with China’s interests.
As tensions in the region rise, they are reflected in the intensification of activity on behalf of the Unfading Sea Haze actor, which uses new and improved tools and TTPs.

We notice]]></content:encoded></item><item><title>Check-Out With Extra Charges - Vulnerabilities in Hotel Booking Engine Explained</title><description><![CDATA[Booking engines – they make the worlds of travel and hospitality spin around. Estimated at over $US 500 billion, this market moves fast. These engines are a critical, nearly invisible part of the hospitality industry, and their security is essential to protect guests’ personal and financial information. Occasionally, booking technology falls victim to motivated threat actors who use vulnerabilities in code to get access to sensitive customer information such as name, address, email address, phon]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/check-out-with-extra-charges-vulnerabilities-in-hotel-booking-engine-explained</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722c0</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Alexandru MAXIMCIUC</dc:creator><pubDate>Thu, 07 Sep 2023 13:03:41 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/09/hotel-cover.jpg" medium="image"/><content:encoded><![CDATA[Booking engines – they make the worlds of travel and hospitality spin around. Estimated at over $US 500 billion, this market moves fast. These engines are a critical, nearly invisible part of the hospitality industry, and their security is essential to protect guests’ personal and financial information. Occasionally, booking technology falls victim to motivated threat actors who use vulnerabilities in code to get access to sensitive customer information such as name, address, email address, phon]]></content:encoded></item><item><title>Abusing the Ad Network – Threat Actors Now Hacking into Companies via Search</title><description><![CDATA[
For the past few years, hackers have increasingly targeted customers and businesses with tainted software boosted via ads. The recipe is simple – cyber-criminal groups set up fake websites for high-interest software and promote them on top of the results page through advertisements.

It takes just one search and one click for a user to fall victim to the trick. Testament to that is the series of attacks against prominent crypto-currency figures earlier in 2023 as well as a recent spate of incid]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/abusing-the-ad-network-threat-actors-now-hacking-into-companies-via-search</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722bf</guid><category><![CDATA[Whitepapers]]></category><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Victor VRABIE</dc:creator><pubDate>Wed, 26 Jul 2023 22:06:38 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/07/email-g4a0b69e04_1920.png" medium="image"/><content:encoded><![CDATA[
For the past few years, hackers have increasingly targeted customers and businesses with tainted software boosted via ads. The recipe is simple – cyber-criminal groups set up fake websites for high-interest software and promote them on top of the results page through advertisements.

It takes just one search and one click for a user to fall victim to the trick. Testament to that is the series of attacks against prominent crypto-currency figures earlier in 2023 as well as a recent spate of incid]]></content:encoded></item><item><title>Exposing RDStealer
Deep Dive into a Targeted
Cyber-Attack Against East-Asia
Infrastructure</title><description><![CDATA[Modern cyber-crime rings are becoming increasingly attracted to the use of legitimate components to achieve their goals. Execution of malicious components via DLL hijacking and persisting on affected systems by abusing legitimate scheduled tasks and services are just a few examples of their agility and focus.

State-affiliated actors such as the notorious APT29 group have successfully used this approach in the past by switching a binary responsible for updating Adobe Reader with a malicious comp]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/exposing-rdstealerdeep-dive-into-a-targetedcyber-attack-against-east-asiainfrastructure</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722be</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Victor VRABIE</dc:creator><pubDate>Tue, 20 Jun 2023 10:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/06/antivirus-6114863_1920.jpg" medium="image"/><content:encoded><![CDATA[Modern cyber-crime rings are becoming increasingly attracted to the use of legitimate components to achieve their goals. Execution of malicious components via DLL hijacking and persisting on affected systems by abusing legitimate scheduled tasks and services are just a few examples of their agility and focus.

State-affiliated actors such as the notorious APT29 group have successfully used this approach in the past by switching a binary responsible for updating Adobe Reader with a malicious comp]]></content:encoded></item><item><title>Vulnerabilities identified in
Amazon Fire TV Stick, Insignia
FireOS TV Series</title><description><![CDATA[Streaming devices have become increasingly popular in recent years, and for good reason. Portable, frequently updated and relatively inexpensive when compared to a new smart TV, these devices offer a convenient, cost-effective, and customizable way to access a vast selection of content from the comfort of your own home. Smart TVs and streaming devices account for a whopping 20% [pdf] of all connected IoT devices, and potential vulnerabilities in firmware could affect a significant user base.

As]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/vulnerabilities-identified-amazon-fire-tv-stick-insignia-fire-os-tv-series</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b9</guid><category><![CDATA[IoT Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Tue, 02 May 2023 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/05/old-tv-gab6450206_1920.png" medium="image"/><content:encoded><![CDATA[Streaming devices have become increasingly popular in recent years, and for good reason. Portable, frequently updated and relatively inexpensive when compared to a new smart TV, these devices offer a convenient, cost-effective, and customizable way to access a vast selection of content from the comfort of your own home. Smart TVs and streaming devices account for a whopping 20% [pdf] of all connected IoT devices, and potential vulnerabilities in firmware could affect a significant user base.

As]]></content:encoded></item><item><title>S1deload Stealer – Exploring the
Economics of Social Network
Account Hijacking</title><description><![CDATA[Social networks, which have grown to occupy a significant portion of our lives, have been abused by criminals since their inception. With access to multiple legitimate social media accounts, threat actors can extort significant financial gains or even manipulate public opinion and change the course of elections. On the everyday level, financially motivated groups have created malvertising and spam campaigns and set up fully automated farms of content-sharing websites to increase revenue or sell ]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/s1deload-stealer-exploring-theeconomics-of-social-networkaccount-hijacking</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b6</guid><category><![CDATA[Whitepapers]]></category><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Dávid ÁCS</dc:creator><pubDate>Wed, 22 Feb 2023 14:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/02/s1deloadstealer-header.png" medium="image"/><content:encoded><![CDATA[Social networks, which have grown to occupy a significant portion of our lives, have been abused by criminals since their inception. With access to multiple legitimate social media accounts, threat actors can extort significant financial gains or even manipulate public opinion and change the course of elections. On the everyday level, financially motivated groups have created malvertising and spam campaigns and set up fully automated farms of content-sharing websites to increase revenue or sell ]]></content:encoded></item><item><title>EyeSpy - Iranian Spyware Delivered in VPN Installers</title><description><![CDATA[Consumer VPN solutions have witnessed explosive growth in the past few years. These ubiquitous utilities help users keep their internet traffic private, surf anonymously, and bypass restrictions or censorship. And, while most of the world takes this technology for granted,  users in specific regions - such as the people in Iran - have to try out dozens of apps before they find one that is (still) able to bypass ISP restrictions. And, while some VPNs are fake [here is a guide on how to spot a fak]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/eyespy-iranian-spyware-delivered-in-vpn-installers</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b5</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Janos Gergo SZELES</dc:creator><pubDate>Wed, 11 Jan 2023 10:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/01/eyespy-1.jpg" medium="image"/><content:encoded><![CDATA[Consumer VPN solutions have witnessed explosive growth in the past few years. These ubiquitous utilities help users keep their internet traffic private, surf anonymously, and bypass restrictions or censorship. And, while most of the world takes this technology for granted,  users in specific regions - such as the people in Iran - have to try out dozens of apps before they find one that is (still) able to bypass ISP restrictions. And, while some VPNs are fake [here is a guide on how to spot a fak]]></content:encoded></item><item><title>BackdoorDiplomacy Wields New Tools in Fresh Middle East Campaign</title><description><![CDATA[Bitdefender researchers have uncovered a new cyber-espionage campaign targeting a telecommunications firm in the Middle East. While investigating a set of binaries vulnerable to sideloading attacks, we identified a cyber-espionage operation most likely carried out by Chinese threat actor BackdoorDiplomacy.

Who is BackdoorDiplomacy?

APT group BackdoorDiplomacy, which has been operating at least since 2017, is known for its attacks against institutions in the Middle East and Africa as well as in]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/backdoor-diplomacy-wields-new-tools-in-fresh-middle-east-campaign</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b2</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Adrian SCHIPOR</dc:creator><pubDate>Tue, 06 Dec 2022 14:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/12/Data_Protection_-_Digital_Umbrella_Over_Binary_Code.jpg" medium="image"/><content:encoded><![CDATA[Bitdefender researchers have uncovered a new cyber-espionage campaign targeting a telecommunications firm in the Middle East. While investigating a set of binaries vulnerable to sideloading attacks, we identified a cyber-espionage operation most likely carried out by Chinese threat actor BackdoorDiplomacy.

Who is BackdoorDiplomacy?

APT group BackdoorDiplomacy, which has been operating at least since 2017, is known for its attacks against institutions in the Middle East and Africa as well as in]]></content:encoded></item><item><title>Vulnerabilities Identified in EZVIZ Smart Cams</title><description><![CDATA[As the creator of the world’s first smart home cybersecurity hub, Bitdefender regularly audits popular IoT hardware for vulnerabilities that might affect customers if left unaddressed. This research paper is part of a broader program that aims to shed light on the security of the world’s best-sellers in the IoT space. This report covers several camera models manufactured by EZVIZ. Full details are included in the research paper below:

Download the research paper


Vulnerabilities at a glance

 ]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/vulnerabilities-identified-in-ezviz-smart-cams</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722ac</guid><category><![CDATA[IoT Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 15 Sep 2022 13:05:28 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/09/technology-gbbc352657_1920.jpg" medium="image"/><content:encoded><![CDATA[As the creator of the world’s first smart home cybersecurity hub, Bitdefender regularly audits popular IoT hardware for vulnerabilities that might affect customers if left unaddressed. This research paper is part of a broader program that aims to shed light on the security of the world’s best-sellers in the IoT space. This report covers several camera models manufactured by EZVIZ. Full details are included in the research paper below:

Download the research paper


Vulnerabilities at a glance

 ]]></content:encoded></item><item><title>A Red Team Perspective on the Device42 Asset Management Appliance</title><description><![CDATA[Modern IT environments rely on automatic discovery, asset management, and dependency mapping.

Whether based on agents or completely agentless, these tools allow IT infrastructure managers to create a complete inventory of networked devices, servers and hypervisors, applications, and more.

While investigating the Device42 platform, we found multiple severe security issues exploitable by attackers with any level of access within the host network.

By exploiting these issues, an attacker could im]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722aa</guid><category><![CDATA[Whitepapers]]></category><category><![CDATA[Miscellaneous]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 10 Aug 2022 10:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/08/Internet_Security_Concept_-_Safe_and_Secure_Network.jpg" medium="image"/><content:encoded><![CDATA[Modern IT environments rely on automatic discovery, asset management, and dependency mapping.

Whether based on agents or completely agentless, these tools allow IT infrastructure managers to create a complete inventory of networked devices, servers and hypervisors, applications, and more.

While investigating the Device42 platform, we found multiple severe security issues exploitable by attackers with any level of access within the host network.

By exploiting these issues, an attacker could im]]></content:encoded></item><item><title>Under Siege for Months: the Anatomy of an Industrial Espionage Operation</title><description><![CDATA[Providing security to customers is a complex and resource-intensive endeavor in a complex world of deeply integrated technologies. As part of our commitment to keeping customers safe, we often complement our security stack offerings with managed detection and response, threat hunting and constant monitoring of customer infrastructure. The Cyber-Threat Intelligence Lab keeps a close eye on alerts and EDR reports coming from infrastructure, helping owners and maintainers navigate the early stages ]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/under-siege-for-months-the-anatomy-of-an-industrial-espionage-operation</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722a9</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Alexandru MAXIMCIUC</dc:creator><pubDate>Tue, 19 Jul 2022 13:04:18 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/07/china-hacking.jpg" medium="image"/><content:encoded><![CDATA[Providing security to customers is a complex and resource-intensive endeavor in a complex world of deeply integrated technologies. As part of our commitment to keeping customers safe, we often complement our security stack offerings with managed detection and response, threat hunting and constant monitoring of customer infrastructure. The Cyber-Threat Intelligence Lab keeps a close eye on alerts and EDR reports coming from infrastructure, helping owners and maintainers navigate the early stages ]]></content:encoded></item><item><title>RIG Exploit Kit Swaps Dead Raccoon with Dridex</title><description><![CDATA[In January 2022, the Cyber Threat Intelligence Lab started tracking a RIG Exploit Kit campaign pushing Raccoon Stealer – a credential-stealing Trojan advertised and sold on underground forums as malware-as-a-service for $ 200 a month.

RIG Exploit Kit is known to be used in conjunction with stealers such as RedLine (documented by Bitdefender earlier in April). The campaign tracked by Bitdefender has taken an unexpected turn in February when Raccoon Stealer came to a temporary halt as one of the ]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/rig-exploit-kit-swaps-dead-raccoon-with-dridex</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722a8</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Mihai NEAGU</dc:creator><pubDate>Tue, 21 Jun 2022 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/06/raccoon-stealer.jpg" medium="image"/><content:encoded><![CDATA[In January 2022, the Cyber Threat Intelligence Lab started tracking a RIG Exploit Kit campaign pushing Raccoon Stealer – a credential-stealing Trojan advertised and sold on underground forums as malware-as-a-service for $ 200 a month.

RIG Exploit Kit is known to be used in conjunction with stealers such as RedLine (documented by Bitdefender earlier in April). The campaign tracked by Bitdefender has taken an unexpected turn in February when Raccoon Stealer came to a temporary halt as one of the ]]></content:encoded></item><item><title>Vulnerabilities Identified in Eufy
2K Indoor Camera</title><description><![CDATA[At Bitdefender, we care deeply about security, so we’ve been working with media partners and IoT device manufacturers to identify vulnerabilities in the world’s best-selling connected devices. As the creator of the world’s first smart home cybersecurity hub, Bitdefender regularly audits popular IoT hardware for vulnerabilities that might affect customers if left unaddressed. This research paper is part of a broader program that aims to shed light on the security of the world’s best-sellers in th]]></description><link>https://www.bitdefender.com/en-gb/blog/labs/vulnerabilities-identified-in-eufy2k-indoor-camera</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722a7</guid><category><![CDATA[IoT Research]]></category><category><![CDATA[Whitepapers]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Tue, 31 May 2022 09:03:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/05/iot-device-management.jpg" medium="image"/><content:encoded><![CDATA[At Bitdefender, we care deeply about security, so we’ve been working with media partners and IoT device manufacturers to identify vulnerabilities in the world’s best-selling connected devices. As the creator of the world’s first smart home cybersecurity hub, Bitdefender regularly audits popular IoT hardware for vulnerabilities that might affect customers if left unaddressed. This research paper is part of a broader program that aims to shed light on the security of the world’s best-sellers in th]]></content:encoded></item></channel>
        </rss>