The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a new emergency directive ordering federal agencies to mitigate an actively exploited vulnerability in Pulse Connect Secure (PCS) VPN appliances on their networks by Friday.
CISA issued the Emergency Directive (ED) 21-03 Tuesday after Pulse Secure confirmed a FireEye report saying that at least two state-backed threat groups exploited the bug (tracked as CVE-2021-22893) to breach government and defense organizations in the US and across the globe.
As CISA explained, attackers exploit this vulnerability in conjunction with older ones to gain persistent system access and take over enterprise networks with vulnerable PCS devices.
Agencies told to check for compromise signs every day
Until the mitigation measures are applied, Federal Civilian Executive Branch departments and agencies were also told to run the Pulse Connect Secure Integrity Tool on all PCS appliances every 24 hours to check for evidence of compromise.
"This tool checks the integrity of the file system and detects any mismatch of hashes," CISA said. "Adversaries are known to maintain persistence over upgrade cycles, and it is critical to run the tool even if all updates have already been deployed and the appliance is running the latest version of software."
If any signs of malicious activity are found, CISA instructed the agencies to isolate the appliances and reach out to Pulse Secure to collect forensic evidence of the intrusion.
The agencies have to take remediation measures for all affected appliances and return them to production only after forensic artifacts have been harvested and analysis has been completed.
To address the vulnerability, Pulse Secure advises customers with gateways running PCS 9.0R3 and higher to upgrade the server software to 9.1R.11.4 immediately after its release in May.
Meanwhile, as a workaround, CVE-2021-22893 can be mitigated by disabling Windows File Share Browser and Pulse Secure Collaboration features using instructions available in the security advisory.
Chinese state hackers likely behind attacks
Threat actors tracked as UNC2630 (potentially tied to the Chinese-backed APT5) and UNC2717 by cybersecurity firm FireEye took over Pulse Secure appliances using both CVE-2021-22893 and older bugs.
After gaining a foothold on targeted US and European organizations' networks, they deployed multiple malware strains with backdoor and web shell capabilities.
According to the FireEye:
- UNC2630 targeted U.S. DIB companies with SLOWPULSE, RADIALPULSE, THINBLOOD, ATRIUM, PACEMAKER, SLIGHTPULSE, and PULSECHECK as early as August 2020 until March 2021.
- UNC2717 targeted global government agencies between October 2020 and March 2021 using HARDPULSE, QUIETPULSE, AND PULSEJUMP.
"They developed malware that enabled them to harvest Active Directory credentials and bypass multifactor authentication on Pulse Secure devices to access victim networks," Charles Carmakal, FireEye Mandiant SVP and CTO, told BleepingComputer.
"They modified scripts on the Pulse Secure system which enabled the malware to survive software updates and factory resets."
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now