Suspected Chinese hackers exploit Pulse Secure VPN to compromise ‘dozens’ of agencies and companies in US and Europe

Suspected Chinese hackers exploit Pulse Secure VPN to compromise ‘dozens’ of agencies and companies in US and Europe

by

The alarming report highlights how hackers have repeatedly taken advantage of several known bugs and one newfound vulnerability in Pulse Secure VPN, a multiple remote connectivity tool, to gain access to dozens of organizations in the defense industry.

Tuesday’s revelations represent the latest cyber security crisis to hit the US, following the SolarWinds hacking campaign by the Russian foreign intelligence service and a series of server software that Microsoft attributed to Chinese state-sponsored hackers.
The U.S. Department of Homeland Security confirmed the intrusions in its own public opinion on Tuesday, urging network administrators to use a special tool designed to look for signs of compromise and to install an emergency solution, published by Ivanti, the owner from Pulse Secure.

The attackers who exploited Pulse Secure were extremely sophisticated and used their access to steal bills and other sensitive data from victim organizations, said Charles Carmakal, senior vice president of FireEye.

“These actors are highly skilled and have deep technical knowledge of the Pulse Secure product,” Carmakal said.

Some of the vulnerabilities exploiting the vulnerabilities started as early as August last year, according to the FireEye report. The report carrying out the attacks possibly works for the Chinese government, and Carmakal added that there are some similarities between portions of this activity and a Chinese actor we call APT5. ‘

Other actors also took advantage of the vulnerabilities, but FireEye said it was unclear whether it could be linked to a specific government.

Hunting the Hunters: How Russian Cybercriminals Targeted First Cybercrime Reaction in SolarWinds Violation
In a blog post, Pulse Secure said that the newly discovered bug has a ‘very limited number of customers’ and that a more permanent software update to address the vulnerability will be released in early May. Software stickers already exist for the other vulnerabilities.

“The Pulse Connect Secure (PCS) team is in contact with a limited number of customers who have had evidence of exploiting their PCS devices,” Pulse Secure said. “The PCS team provided immediate remediation to these customers.”

It also said: “Customers are also encouraged to apply the efficient and easy use of the Pulse Secure Integrity Checker Tool to identify any unusual activity on their system.”

The DHS Cybersecurity and Infrastructure Security Agency said it had been assisting “several entities” whose vulnerable products had been exploited by a cyber-threat actor since March 31.

“CISA has partnered closely with Ivanti, Inc. to better understand the vulnerabilities in Pulse Secure VPN devices and to reduce potential risks to federal networks in the civil and private sectors,” said Nicky Vogt, a spokeswoman for the agency. , Said Tuesday. “We will continue to provide guidance and recommendations to support organizations that may be affected.”

.Source