DHS Warns of Continuing Cyberattacks Exploiting Pulse Secure VPN Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to Pulse Secure customers urging them to patch the 2019 Pulse Secure VPN vulnerability, CVE-2019-11510.
Pulse Secure VPN servers that have not been patched are continuing to be attacked by cybercriminals. The threat actors behind Sodinokibi (REvil) ransomware are targeting unpatched Pulse Secure VPN servers and are exploiting CVE-2019-11510 to install ransomware. Several attacks have been reported in January 2020. In addition to encrypting data, the attackers are stealing and threatening to publish victims’ sensitive information. Last week data belonging to Artech Information Systems was published when the ransom was not paid.
CISA continues to see widespread exploitation of the flaw by multiple threat actors, including nation-state sponsored advanced persistent threat actors, who are exploiting the flaw to steal passwords, data, and deploy malware.
Exploitation of the vulnerability can allow a remote, unauthenticated attacker to gain access to all active VPN users and obtain their plain-text passwords. According to CISA, an attacker may also be able to execute arbitrary code on VPN clients when they successfully connect to an unpatched Pulse Secure VPN server.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Pulse Secure issued an advisory about the vulnerability on April 24, 2019 and patches were released to fix the flaw on all affected Pulse Connect Secure and Pulse Policy Secure versions, yet many organizations have been slow to apply the patches. Since there are no mitigations or workarounds that can be implemented to prevent exploitation of the vulnerability, the only solution is to apply the patches released by Pulse Secure.
CISA has urged all organizations to apply the patches as soon as possible to prevent exploitation of the vulnerability. It has been estimated that around 10% of Pulse Secure customers have not yet applied the patch and are vulnerable to attack.
