Hackers are actively targeting flaws in these VPN devices. Here’s what you need to do

Hackers are actively exploiting a newly discovered flaw in Pulse Connect Secure VPN products, alongside some older flaws that some customers have yet to patch. 

© Getty Images/iStockphoto

Young women using computer, Cyber security concept.

Cybersecurity firm FireEye reported it has been investigating multiple incidents of compromises of the devices that use a bug tracked as CVE-2021-22893 that was discovered in April. It’s an significant vulnerability with a severity score of 10 out of a possible 10 and the malware being deployed is designed to bypass two-factor authentication. 

The vulnerability includes an authentication bypass that can “allow an unauthenticated user to perform remote arbitrary file execution on the Pulse Connect Secure gateway,” according to Pulse Secure’s advisory. 

SEE: VPN: Picking a provider and troubleshooting tips (free PDF) (TechRepublic)

FireEye’s incident response unit Mandiant says it is tracking 12 malware families linked to attacks on Pulse Secure VPN appliances that use this bug in combination with older bugs affecting the software. 

FireEye has attributed the activity to a group it labels UNC2630, a suspected China state-sponsored hacking group that has allegedly targeted the US Defense industry and European organizations. 

US-based IT asset management firm Ivanti has released the Pulse Connect Secure Integrity Tool and other mitigations for the bug that’s under attack. 

The US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA)  said the attacks on this VPN product began in June 2020: other bugs the attackers have used include CVE-2019-11510, CVE-2020-8260, and CVE-2020-8243, which allow them to install web shells to gain persistence on the device. 

As ZDNet reported last August, attackers have been scanning the internet for Pulse Secure VPN servers with these flaws since June because the VPNs are used by staff to remotely access internal apps. 

“The threat actor is using this access to place web shells on the Pulse Connect Secure appliance for further access and persistence. The known web shells allow for a variety of functions, including authentication bypass,…