Authentication and VPN - Cyber Security Informer

Threat Spotlight: Credential Theft vs. Admin Control—Two Devastating Paths to VPN Exploitation

Digital Shadows

MARCH 17, 2025

Key Findings Even years after their disclosure, VPN-related vulnerabilities like CVE-2018-13379 and CVE-2022-40684 remain essential tools for attackers, driving large-scale campaigns of credential theft and administrative control. How AI and automation are amplifying the scale and sophistication of VPN attacks.

VPN

VPN Authentication Ransomware Risk

China-linked actor’s malware DeepData exploits FortiClient VPN zero-day

Security Affairs

NOVEMBER 19, 2024

Chinese threat actors use custom post-exploitation toolkit ‘DeepData’ to exploit FortiClient VPN zero-day and steal credentials. Volexity researchers discovered a vulnerability in Fortinet’s Windows VPN client that China-linked threat actor BrazenBamboo abused in their DEEPDATA malware. ” reads the advisory.

VPN

VPN Malware Spyware Passwords

SonicWall warns of an exploitable SonicOS vulnerability

Security Affairs

JANUARY 8, 2025

SonicWall warns customers to address an authentication bypass vulnerability in its firewall’s SonicOS that is “susceptible to actual exploitation.” The vulnerability resides in SSL VPN and SSH management and according to the vendor is “susceptible to actual exploitation.” 6n or newer Gen 6 / 6.5

Firewall

Firewall Firmware VPN Authentication

FBI, CISA Echo Warnings on ‘Vishing’ Threat

Krebs on Security

AUGUST 21, 2020

The advisory came less than 24 hours after KrebsOnSecurity published an in-depth look at a crime group offering a service that people can hire to steal VPN credentials and other sensitive data from employees working remotely during the Coronavirus pandemic. authenticate the phone call before sensitive information can be discussed.

VPN

VPN Social Engineering Authentication Engineering

U.S. CISA adds Array Networks AG and vxAG ArrayOS flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

NOVEMBER 26, 2024

Attackers can exploit the SSL VPN gateway by accessing the filesystem via an HTTP header flags attribute and a vulnerable URL without authentication. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. ” reads the advisory.

VPN

VPN Authentication Hacking Cybersecurity

U.S. CISA adds Veeam Backup and Replication flaw to its Known Exploited Vulnerabilities catalog

Security Affairs

OCTOBER 19, 2024

Attackers accessed targets via VPN gateways lacking multifactor authentication, some of which ran outdated software. In each of the cases, attackers initially accessed targets using compromised VPN gateways without multifactor authentication enabled. Some of these VPNs were running unsupported software versions.”

Backups

Backups VPN Ransomware Authentication

Cisco warns of large-scale brute-force attacks against VPN and SSH services

Security Affairs

APRIL 16, 2024

Cisco Talos warns of large-scale brute-force attacks against a variety of targets, including VPN services, web application authentication interfaces and SSH services.

VPN

VPN Firewall Authentication Hacking

NSA, CISA release guidance on hardening remote access via VPN solutions

Security Affairs

SEPTEMBER 29, 2021

CISA and the NSA agencies have published guidance for securely using virtual private network (VPN) solutions. Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have released guidance for increasing the security of virtual private network (VPN) solutions.

VPN

VPN Government Firmware Authentication

New TunnelVision technique can bypass the VPN encapsulation

Security Affairs

MAY 8, 2024

TunnelVision is a new VPN bypass technique that enables threat actors to spy on users’ traffic bypassing the VPN encapsulation. Leviathan Security researchers recently identified a novel attack technique, dubbed TunnelVision, to bypass VPN encapsulation. The researchers referred to this result as “decloaking.”

VPN

VPN Firewall Marketing Encryption

Check Point released hotfix for actively exploited VPN zero-day

Security Affairs

MAY 29, 2024

Check Point released hotfixes for a VPN zero-day vulnerability, tracked as CVE-2024-24919, which is actively exploited in attacks in the wild. Check Point released hotfixes to address a VPN zero-day vulnerability, tracked as CVE-2024-24919 , which is actively being exploited in attacks in the wild.

VPN

VPN Passwords Authentication Accountability

Voice Phishers Targeting Corporate VPNs

Krebs on Security

AUGUST 19, 2020

But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees. The employee phishing page bofaticket[.]com. Image: urlscan.io. ” SPEAR VISHING.

Phishing

Phishing VPN Social Engineering Media

Feds Charge Five Men in ‘Scattered Spider’ Roundup

Krebs on Security

NOVEMBER 21, 2024

The targeted SMS scams asked employees to click a link and log in at a website that mimicked their employer’s Okta authentication page. Some SMS phishing messages told employees their VPN credentials were expiring and needed to be changed; other phishing messages advised employees about changes to their upcoming work schedule.

Identity Theft

Identity Theft Phishing Cryptocurrency Accountability

Akira Ransomware gang targets Cisco ASA without Multi-Factor Authentication

Security Affairs

AUGUST 31, 2023

Cisco is aware of attacks conducted by Akira ransomware threat actors targeting Cisco ASA VPNs that are not configured for multi-factor authentication. “This highlights the importance of enabling multi-factor authentication (MFA) in VPN implementations. . ” reads a post published by Cisco PSIRT.

Authentication

Authentication Ransomware VPN Hacking

Fortinet fixes critical RCE flaw in Fortigate SSL-VPN devices, patch now

Bleeping Computer

JUNE 11, 2023

Fortinet has released new Fortigate firmware updates that fix an undisclosed, critical pre-authentication remote code execution vulnerability in SSL VPN devices. [.]

VPN

VPN Firmware Authentication

A zero-day in Atlas VPN Linux Client leaks users’ IP address

Security Affairs

SEPTEMBER 6, 2023

Experts warn of an Atlas VPN zero-day flaw impacting the Linux client that can reveal the user’s IP address by visiting a website. A Reddit user with the handle ‘Educational-Map-8145’ published a proof of concept exploit for a zero-day flaw in the Linux client of Atlas VPN. It does not have ANY authentication.

VPN

VPN Education Authentication Engineering

Cisco Warns of Global Surge in Brute-Force Attacks Targeting VPN and SSH Services

The Hacker News

APRIL 17, 2024

Cisco is warning about a global surge in brute-force attacks targeting various devices, including Virtual Private Network (VPN) services, web application authentication interfaces, and SSH services, since at least March 18, 2024.

VPN

VPN Authentication

Revolutionizing Cisco VPN Access with Duo SSO

Duo's Security Blog

JANUARY 11, 2024

Secure Cisco VPN logins in less than an hour Authenticate users in seconds Verify user + device posture Blog unmanaged devices Mitigate modern security threats with phishing-resistant authentication Join the thousands of Cisco firewall customers who take advantage of protecting Cisco VPN logins with Cisco Duo Single Sign-On via SAML 2.0

VPN

VPN Authentication Firewall Risk

Cell Phone Location Privacy

Schneier on Security

JANUARY 15, 2021

Monthly: The user pays their bill to the MVNO (credit card or otherwise) and the phone gets anonymous authentication (using Chaum blind signatures) tokens for each time slice (e.g., If it’s valid, the MVNO tells the MNO that the user is authenticated, and the user receives a temporary random ID and an IP address.

Surveillance

Surveillance Mobile Authentication VPN

Check Point Warns of Hackers Targeting Its Remote Access VPN

SecureWorld News

MAY 28, 2024

Threat actors are targeting Check Point Remote Access VPN devices in an ongoing campaign to breach enterprise networks, the company has warned in a new advisory. We have recently witnessed compromised VPN solutions, including various cyber security vendors.

VPN

VPN Passwords Authentication Architecture

GoDaddy Employees Used in Attacks on Multiple Cryptocurrency Services

Krebs on Security

NOVEMBER 21, 2020

The phishers often will explain that they’re calling from the employer’s IT department to help troubleshoot issues with the company’s email or virtual private networking (VPN) technology. Restrict VPN access hours, where applicable, to mitigate access outside of allowed times.

Cryptocurrency

Cryptocurrency VPN Scams Social Engineering

U.S. CISA adds Cisco ASA and FTD, and RoundCube Webmail bugs to its Known Exploited Vulnerabilities catalog

Security Affairs

OCTOBER 25, 2024

is a Denial of Service (DoS) issue that impacts the Remote Access VPN (RAVPN) service of ASA and FTD. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. Services that are not related to VPN are not affected.” continues the advisory.

VPN

VPN Firewall Technology Passwords

Announcing Duo’s Vision to Streamline Authentication & Enhance User Experience

Duo's Security Blog

JUNE 8, 2023

Some of it is positive, but the general consensus is that people don’t love multi-factor authentication (MFA); they see it as a necessary evil at best. That’s why I’m so excited to announce our vision to streamline Duo’s authentication workflows, a feature that will deliver seamless, secure login experiences.

Authentication

Authentication VPN System Administration Engineering

Making Seamless Authentication a Reality for MSP Customers

Duo's Security Blog

APRIL 3, 2025

While the enforcement of multi-factor authentication (MFA) makes logging in more secure, it inevitably runs the risk of adding steps to a process users already find annoying. While this may avoid authentication fatigue, it certainly risks and may even violate some security standards.

Authentication

Authentication Passwords Risk VPN

Experts warn of mass exploitation of Ivanti Connect Secure VPN flaws

Security Affairs

JANUARY 16, 2024

Experts warn that recently disclosed Ivanti Connect Secure VPN and Policy Secure vulnerabilities are massively exploited in the wild. is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x, The flaw CVE-2023-46805 (CVSS score 8.2) x and Ivanti Policy Secure. x) and Ivanti Policy Secure.

VPN

VPN Authentication Small Business Telecommunications

ASUS fixed critical remote authentication bypass bug in several routers

Security Affairs

JUNE 16, 2024

Taiwanese manufacturer giant ASUS addressed a critical remote authentication bypass vulnerability impacting several router models. ASUS addresses a critical remote authentication bypass vulnerability, tracked as CVE-2024-3080 (CVSS v3.1 score: 9.8), impacting seven router models. impacting multiple devices.

Authentication

Authentication Firmware VPN Manufacturing

How to protect your organization against the latest malware threats

Tech Republic Security

MAY 13, 2020

With the shift toward remote working, cybercriminals have been targeting exploits in VPN, Internet of Things, and authentication technology, says cybersecurity firm Nuspire.

VPN

VPN Malware Authentication Internet

Multiple malware used in attacks exploiting Ivanti VPN flaws

Security Affairs

FEBRUARY 1, 2024

Mandiant spotted new malware used by a China-linked threat actor UNC5221 targeting Ivanti Connect Secure VPN and Policy Secure devices. Mandiant researchers discovered new malware employed by a China-linked APT group known as UNC5221 and other threat groups targeting Ivanti Connect Secure VPN and Policy Secure devices.

VPN

VPN Malware Authentication Hacking

How Does a VPN Work? A Comprehensive Beginner’s Overview

eSecurity Planet

AUGUST 27, 2024

A virtual private network (VPN) does more than just mask your identity—it fundamentally changes how your data moves across the internet. But what’s really going on under the hood when you browse the web using a VPN? Step 3: Data Transmission to the VPN Server The encrypted data is then transmitted to the VPN server.

VPN

VPN Encryption Internet Internet

Zyxel firewalls targeted in recent ransomware attacks

Security Affairs

NOVEMBER 25, 2024

According to the advisory, the attack is only possible if the device is configured to use User-Based-PSK authentication and has a valid user with a username longer than 28 characters. for ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN series. . for ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN series.

Firewall

Firewall Ransomware VPN Firmware

Threat actors exploit Ivanti VPN bugs to deploy KrustyLoader Malware

Security Affairs

JANUARY 31, 2024

Threat actors are exploiting recently disclosed zero-day flaws in Ivanti Connect Secure (ICS) VPN devices to deliver KrustyLoader. is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x, The flaw CVE-2023-46805 (CVSS score 8.2) x and Ivanti Policy Secure. x) and Ivanti Policy Secure.

VPN

VPN Malware Authentication Small Business

Supercharging Your Fortinet FortiGate VPN With Duo SSO

Duo's Security Blog

OCTOBER 30, 2024

Let's talk about how Duo SSO is revolutionizing FortiGate VPN access. Picture this: You're securing VPN logins in under an hour, authenticating users in seconds and saying goodbye to those pesky stolen credential risks. Connect your FortiGate VPN to Duo SSO using SAML 2.0 (it's Sounds too good to be true?

VPN

VPN Authentication Firewall Risk

News Alert: i2Coalition launches ‘VPN Trust Initiative’ to promote VPN operators’ best practices

The Last Watchdog

SEPTEMBER 26, 2023

26, 2023 — The Internet Infrastructure Coalition (i2Coalition) launched the VPN Trust Initiative (VTI) in 2020 to establish a baseline for how virtual private network (VPN) providers should operate. Advertising Practices: Given the complexity and different use cases for VPNs, claims must not mislead.

VPN

VPN Internet Internet Technology

Strong Authentication – Robust Identity and Access Management Is a Strategic Choice

Security Affairs

JULY 29, 2022

Therefore, strong authentication methods are needed. Therefore, strong authentication methods are needed to improve security without hindering user convenience. What is Strong Authentication? The IAM Security Boundary Strong authentication is a critical component of modern-day identity and access management.

Authentication

Authentication Passwords Data privacy Identity Theft

Legacy Authentication Protocols: Why RADIUS Is (Still) Important

Duo's Security Blog

MAY 23, 2024

When reading the title of this blog, you might be wondering to yourself why RADIUS is being highlighted as a subject — especially amidst all of the advancements of modern authentication we see taking place recently. It is commonly used for network access into VPNs, wireless access points, and other devices (more on this later).

Authentication

Authentication Wireless Passwords Encryption

CVE-2024-22394 Exposed: SonicWall SSL-VPN’s Authentication Flaw

Penetration Testing

FEBRUARY 9, 2024

Recently, a critical flaw, nestled within the SSL-VPN feature of SonicWall’s SonicOS, has been brought to light, exposing a gap wide enough for remote attackers to slip through unnoticed.

Authentication

Authentication Penetration Testing VPN

U.S. CISA adds SonicWall SonicOS and Palo Alto PAN-OS flaws to its Known Exploited Vulnerabilities catalog

Security Affairs

FEBRUARY 18, 2025

The two vulnerabilities are: CVE-2025-0108 Palo Alto PAN-OS Authentication Bypass Vulnerability CVE-2024-53704 SonicWall SonicOS SSLVPN Improper Authentication Vulnerability Researchers recently warned that threat actors exploit a recently disclosed vulnerability, CVE-2025-0108, in Palo Alto Networks PAN-OS firewalls.

Firewall

Firewall Firmware Authentication VPN

North Korea-linked APT Moonstone used Qilin ransomware in limited attacks

Security Affairs

MARCH 10, 2025

The attackers breached the organization via compromised credentials for a VPN portal that lacked multi-factor authentication (MFA). The threat actors conducted post-exploitation activities eighteen days after initial access.

Ransomware

Ransomware VPN Healthcare Malware

What Is Two-Factor Authentication (2FA) and Why Should You Use It?

IT Security Guru

OCTOBER 26, 2023

Enter Two-Factor Authentication, or 2FA for short. Always use VPN for your safety to protect your data from prying eyes. If 2FA is the bouncer, consider a VPN your personal invisibility cloak, making you nearly untouchable in the digital realm. Authentication Apps: Consider this the artisanal gelato of the 2FA world.

Authentication

Authentication Passwords Mobile VPN

CISA Order Highlights Persistent Risk at Network Edge

Krebs on Security

JUNE 15, 2023

The directive applies to any networking devices — such as firewalls, routers and load balancers — that allow remote authentication or administration. The researchers found that just being able to reach the management interface for a vulnerable Fortinet SSL VPN appliance was enough to completely compromise the devices.

Risk

Risk VPN Internet Internet

Revolutionizing Palo Alto VPN Access With Duo SSO

Duo's Security Blog

AUGUST 6, 2024

Join the thousands of Palo Alto firewall customers who take advantage of protecting Palo Alto VPN logins with Duo Single Sign-On via SAML 2.0 Duo SSO simplifies the authentication process for users by providing a single point of access to multiple applications. to help prevent unwanted access and streamline the user experience.

VPN

VPN Artificial Intelligence Authentication Firewall

Nation-State Actors Weaponize Ivanti VPN Zero-Days, Deploying 5 Malware Families

The Hacker News

JANUARY 12, 2024

As many as five different malware families were deployed by suspected nation-state actors as part of post-exploitation activities leveraging two zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances since early December 2023.

VPN

VPN Malware Authentication

CISA orders federal agencies to disconnect Ivanti VPN instances by February 2

Security Affairs

FEBRUARY 1, 2024

The government experts also ordered to monitor the authentication or identity management services that could be exposed and urged to isolate the systems from any enterprise resources to the greatest degree possible. is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x, x and Ivanti Policy Secure.

VPN

VPN Authentication Software Malware

Q&A: The lesser role VPNs now play for enterprises, SMBs — in a post-pandemic world

The Last Watchdog

JUNE 22, 2022

VPNs encrypt data streams and protect endpoints from unauthorized access, essentially by requiring all network communications to flow over a secured pipe. However, VPN pipes have become less efficient with the rising use of personally-owed mobile devices increasing reliance on cloud-centric IT resources.

VPN

VPN Cloud Migration Firewall Encryption

International law enforcement operation dismantled RedLine and Meta infostealers

Security Affairs

OCTOBER 29, 2024

Change passwords : After malware removal, update passwords for key accounts (email, banking, work, social media) and enable two-factor authentication. Consider extra security layers : Use additional protection like a VPN for safer online activity. Use a password manager : Simplifies managing strong, unique passwords across accounts.

Identity Theft

Identity Theft Passwords Malware Banking

Threat Spotlight: Credential Theft vs. Admin Control—Two Devastating Paths to VPN Exploitation

China-linked actor’s malware DeepData exploits FortiClient VPN zero-day

Trending Sources

SonicWall warns of an exploitable SonicOS vulnerability

FBI, CISA Echo Warnings on ‘Vishing’ Threat

U.S. CISA adds Array Networks AG and vxAG ArrayOS flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA adds Veeam Backup and Replication flaw to its Known Exploited Vulnerabilities catalog

Cisco warns of large-scale brute-force attacks against VPN and SSH services

NSA, CISA release guidance on hardening remote access via VPN solutions

New TunnelVision technique can bypass the VPN encapsulation

Check Point released hotfix for actively exploited VPN zero-day

Voice Phishers Targeting Corporate VPNs

Feds Charge Five Men in ‘Scattered Spider’ Roundup

Akira Ransomware gang targets Cisco ASA without Multi-Factor Authentication

Fortinet fixes critical RCE flaw in Fortigate SSL-VPN devices, patch now

A zero-day in Atlas VPN Linux Client leaks users’ IP address

Cisco Warns of Global Surge in Brute-Force Attacks Targeting VPN and SSH Services

Revolutionizing Cisco VPN Access with Duo SSO

Cell Phone Location Privacy

Check Point Warns of Hackers Targeting Its Remote Access VPN

GoDaddy Employees Used in Attacks on Multiple Cryptocurrency Services

U.S. CISA adds Cisco ASA and FTD, and RoundCube Webmail bugs to its Known Exploited Vulnerabilities catalog

Announcing Duo’s Vision to Streamline Authentication & Enhance User Experience

Making Seamless Authentication a Reality for MSP Customers

Experts warn of mass exploitation of Ivanti Connect Secure VPN flaws

ASUS fixed critical remote authentication bypass bug in several routers

How to protect your organization against the latest malware threats

Multiple malware used in attacks exploiting Ivanti VPN flaws

How Does a VPN Work? A Comprehensive Beginner’s Overview

Zyxel firewalls targeted in recent ransomware attacks

Threat actors exploit Ivanti VPN bugs to deploy KrustyLoader Malware

Supercharging Your Fortinet FortiGate VPN With Duo SSO

News Alert: i2Coalition launches ‘VPN Trust Initiative’ to promote VPN operators’ best practices

Strong Authentication – Robust Identity and Access Management Is a Strategic Choice

Legacy Authentication Protocols: Why RADIUS Is (Still) Important

CVE-2024-22394 Exposed: SonicWall SSL-VPN’s Authentication Flaw

U.S. CISA adds SonicWall SonicOS and Palo Alto PAN-OS flaws to its Known Exploited Vulnerabilities catalog

North Korea-linked APT Moonstone used Qilin ransomware in limited attacks

What Is Two-Factor Authentication (2FA) and Why Should You Use It?

CISA Order Highlights Persistent Risk at Network Edge

Revolutionizing Palo Alto VPN Access With Duo SSO

Nation-State Actors Weaponize Ivanti VPN Zero-Days, Deploying 5 Malware Families

CISA orders federal agencies to disconnect Ivanti VPN instances by February 2

Q&A: The lesser role VPNs now play for enterprises, SMBs — in a post-pandemic world

International law enforcement operation dismantled RedLine and Meta infostealers

Stay Connected