Threat Watch

Stay informed of cybersecurity news & events

APT Using Multiple VPN Vulnerabilities:

Share on facebook
Share on twitter
Share on linkedin

According to the NSA, multiple Advanced Persistent Threat (APT) actors have been exploiting multiple VPN vulnerabilities from several VPN products including Palo Alto GlobalProtect™ and Fortinet Fortigate™ products.  These vulnerabilities allow threat actors to gain remote access to affected networks, which could result in breaches or worse. Patches are available from the VPN product vendors that mitigate the vulnerabilities.  Although the advisory was issued in October 2019, current intelligence indicates that threat actors continue to exploit these unpatched VPN servers.

ANALYST NOTES

The following guidelines were provided by the NSA to prevent or mitigate VPN exploitation: • Immediately upgrade the VPN server software to the latest version. • Reset credentials before reconnecting the upgraded devices to an external network. • Review network accounts to ensure adversaries did not create new accounts. • Update VPN user, administrator, and service account credentials. • Revoke and create new VPN server keys and certificates. For more information, refer to: https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1982939/nsa-cybersecurity-advisory-malicious-cyber-actors-leveraging-vpn-vulnerabilitie/

Contact Support

Please complete the form below and a member of our support team will respond as quickly as possible.