Threat actors are targeting Check Point Remote Access VPN devices in an ongoing campaign to breach enterprise networks, the company warned in a Monday advisory.
Remote Access is integrated into all Check Point network firewalls.
It can be configured as a client-to-site VPN for access to corporate networks via VPN clients or set up as an SSL VPN Portal for web-based access.
Check Point says the attackers are targeting security gateways with old local accounts using insecure password-only authentication, which should be used with certificate authentication to prevent breaches.
To defend against these ongoing attacks, Check Point warned customers to check for such vulnerable accounts on Quantum Security Gateway and CloudGuard Network Security products and on Mobile Access and Remote Access VPN software blades.
Customers are advised to change the user authentication method to more secure options or delete vulnerable local accounts from the Security Management Server database.
The company has also released a Security Gateway hotfix that will block all local accounts from authenticating with a password.
In April, Cisco also warned about widespread credential brute-forcing attacks targeting VPN and SSH services on Cisco, Check Point, SonicWall, Fortinet, and Ubiquiti devices.
That campaign started around March 18, 2024, with the attacks originating from TOR exit nodes and using various other anonymization tools and proxies to evade blocks.
One month earlier, Cisco warned about a wave of password-spraying attacks targeting Cisco Secure Firewall devices running Remote Access VPN services, likely part of first-stage reconnaissance activity.
Last month, the company also revealed that the UAT4356 state-backed hacking group has been using zero-day bugs in Cisco Adaptive Security Appliance and Firepower Threat Defense firewalls to breach government networks worldwide since at least November 2023 in a cyber-espionage campaign tracked as ArcaneDoor.
FBI warns of gift card fraud ring targeting retail companies.
Intercontinental Exchange to pay $10M SEC penalty over VPN breach.
Rockwell Automation warns admins to take ICS devices offline.
Norway recommends replacing SSL VPN to prevent breaches.
Microsoft fixes VPN failures caused by April Windows updates.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 27 May 2024 18:20:41 +0000