Threat actors commonly use older vulnerabilities to gain access to systems that are not patched quickly. it is important to apply updates and patches to systems as soon as they are available to reduce attack from happening. Hacking chains like this, where multiple vulnerabilities are used are becoming more common according to the report. It is important to understand that these two vulnerabilities are not the only ones that an attack like this can occur with. Any VPN vulnerability could allow an attacker to exploit it and move on to compromise the network. With the 2020 election moving closer, attacks that involve elections systems and entities will become more common. The threat actors behind the attack are not mentioned in the report but Microsoft warned last week that Iranian APT Mercury (Muddy Water) was seen exploiting the Zerologon vulnerability. Iran has also been seen targeting US government entities in the past. The CISA did not state at this time whether this attack chain is being used by Iranian actors.

More can be read here: https://www.zdnet.com/article/hacker-groups-chain-vpn-and-windows-bugs-to-attack-us-government-networks/