Latest cybersecurity reporting from selected sources.

A routine RDP brute-force alert led to unusual credential hunting and a geo-distributed VPN-linked infrastructure. Huntress Labs explains how one compromised login unraveled a suspected ransomware-as-a-service ecosystem tied to initial access brokers. [...]

Chinese-speaking threat actors are suspected to have leveraged a compromised SonicWall VPN appliance as an initial access vector to deploy a VMware ESXi exploit that may have been developed as far back as February 2024

Beazley Security data finds the top cause of initial access for ransomware in Q3 was compromised VPN credentials

Threat actors affiliated with the Akira ransomware group have continued to target SonicWall devices for initial access

Fortinet has revealed that threat actors have found a way to maintain read-only access to vulnerable FortiGate devices even after the initial access vector used to breach the devices was patched

Travelers found that ransomware groups are focusing on targeting weak credentials on VPN and gateway accounts for initial access, marking a shift from 2023

Forescout highlighted a 43% increase in published vulnerabilities in H1 2024, with attackers targeting flaws in VPNs and network infrastructure for initial access

Using VPNs as an initial access vector is ironic, given that security is the very reason enterprises employ them in the first place.

Criminal and Nation-State Focus on Network Edge Devices Continues, Researchers WarnAttackers have been escalating their attempts to compromise poorly secured virtual private networks - including appliances set for password-only authentication - to gain remote, initial access to enterprise networks, Check Point Software Technologies warns.

Cisco is warning of a zero-day vulnerability in its Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) that is actively exploited by ransomware operations to gain initial access to corporate networks. [...]

Initial access brokers still play a key role in threat supply chain

Cybersecurity researchers have shed light on a new ransomware strain called CACTUS that has been found to leverage known flaws in VPN appliances to obtain initial access to targeted networks

A new ransomware operation called Cactus has been exploiting vulnerabilities in VPN appliances for initial access to networks of "large commercial entities." [...]

Networking equipment major Cisco on Wednesday confirmed it was the victim of a cyberattack on May 24, 2022 after the attackers got hold of an employee's personal Google account that contained passwords synced from their web browser

Networking giant says attackers gained initial access to an employee’s VPN client via a compromised Google account.