Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

ronjor · Apr 16, 2020

Original release date: April 16, 2020

This Alert provides an update to Cybersecurity and Infrastructure Security Agency (CISA) Alert AA20-010A: Continued Exploitation of Pulse Secure VPN Vulnerability, which advised organizations to immediately patch CVE-2019-11510—an arbitrary file reading vulnerability affecting Pulse Secure virtual private network (VPN) appliances.[1]
CISA is providing this update to alert administrators that threat actors who successfully exploited CVE-2019-11510 and stole a victim organization’s credentials will still be able to access—and move laterally through—that organization’s network after the organization has patched this vulnerability if the organization did not change those stolen credentials.
This Alert provides new detection methods for this activity, including a CISA-developed tool
that helps network administrators search for indicators of compromise (IOCs) associated with exploitation of CVE-2019-11510. This Alert also provides mitigations for victim organizations to recover from attacks resulting from CVE-2019-11510. CISA encourages network administrators to remain aware of the ramifications of exploitation of CVE-2019-11510 and to apply the detection measures and mitigations provided in this report to secure networks against these attacks.
Click to expand...

Minimalist · Apr 18, 2020

US govt: Hacker used stolen AD credentials to ransom hospitals

Hackers have deployed ransomware on the systems of U.S. hospitals and government entities using Active Directory credentials stolen months after exploiting a known pre-auth remote code execution (RCE) vulnerability in their Pulse Secure VPN servers.
Click to expand...

https://www.bleepingcomputer.com/ne...ed-stolen-ad-credentials-to-ransom-hospitals/

guest · Jun 13, 2020

Black Kingdom ransomware hacks networks with Pulse VPN flaws
June 13, 2020
https://www.bleepingcomputer.com/ne...nsomware-hacks-networks-with-pulse-vpn-flaws/

Operators of Black Kingdom ransomware are targeting enterprises with unpatched Pulse Secure VPN software or initial access on the network, security researchers have found.
Modus operandi
They’re exploiting CVE-2019-11510, a critical vulnerability affecting earlier versions of Pulse Secure VPN that was patched in April 2019. Companies delayed updating their software even after exploits became public, prompting multiple alerts from the U.S. government and threat actors started leveraging it; some organizations continue to run a vulnerable version of the product.

REDTEAM.PL, a company offering cybersecurity services based in Poland, observed that Black Kingdom operators used the same doorway provided by Pulse Secure VPN to breach what they believed was a target.
Click to expand...

Log in or Sign up

Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

ronjor Global Moderator

Minimalist Registered Member

guest Guest

Log in or Sign up

Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

ronjor Global Moderator

Minimalist Registered Member

guest Guest

Useful Searches