Security News > 2020 > February > Unpatched VPN Servers Hit by Apparent Iranian APT Groups

Now, security firm ClearSky says that at least three advanced persistent threat groups, all with apparent ties to the Iranian government, have been joining the fray and hitting unpatched Fortinet, Pulse Secure and Palo Alto Networks VPN servers and Citrix remote gateways.

Specific flaws needing to be patched include CVE-2019-11510 in Pulse Secure's VPN SSL servers, CVE-2018-13379 in Fortigate's SSL VPN servers, and CVE-2019-1579 in Palo Alto Network VPN servers, all of which ClearSky says Fox Kitten is now exploiting.

These vulnerabilities have previously been used by other cybercrime groups to spread malware, such as ransomware, but the three apparent Iranian groups have increasingly started to use these flaws for their own purposes - namely to attempt to steal data, ClearSky says.

"The most successful and significant attack vector used by the Iranian APT groups in the last three years has been the exploitation of known vulnerabilities in systems with unpatched VPN and services, in order to infiltrate and take control over critical corporate information storage," according to the ClearSky report.

The apparent Iranian APT groups are using the vulnerabilities in the VPN and servers and remote systems to gain a foothold in networks, ClearSky researchers say.

News URL

https://www.inforisktoday.com/unpatched-vpn-servers-hit-by-apparent-iranian-apt-groups-a-13733