Ransomware gangs are abusing a zero-day in EntroLink VPN appliances

guest · Oct 26, 2021

Ransomware gangs are abusing a zero-day in EntroLink VPN appliances
October 25, 2021
https://therecord.media/ransomware-gangs-are-abusing-a-zero-day-in-entrolink-vpn-appliances/

Multiple ransomware gangs have weaponized and are abusing a zero-day in EntroLink VPN appliances after an exploit was released on an underground cybercrime forum at the start of September 2021.

The zero-day is believed to impact EntroLink PPX-AnyLink devices, popular with South Korean companies, and used as user authentication gateways and VPNs to allow employees remote access to company networks and internal resources.
Click to expand...

According to the forum post, the exploit is still unpatched, exploits a network protocol, and grants remote code execution with root-level access to PPX-AnyLink devices.

Since the exploit’s release, affiliates for the BlackMatter and LockBit ransomware operations have been linked to possible intrusions where this exploit might have been used, according to a researcher who is currently tracking and investigating ransomware attacks.
EntroLink, the South Korean networking vendor, was notified of the exploit’s release by the security researcher.
Click to expand...

The EntroLink PPX-AnyLink exploit now becomes the 54th zero-day vulnerability that ransomware gangs are currently known to abuse, according to a tracker managed by security researchers Allan Liska and Pancak3.
Click to expand...

Log in or Sign up

Ransomware gangs are abusing a zero-day in EntroLink VPN appliances

guest Guest

Log in or Sign up

Ransomware gangs are abusing a zero-day in EntroLink VPN appliances

guest Guest

Useful Searches