Dive Brief:
- Check Point Software Technologies is warning its customers that malicious actors are attempting to hack a small number of targeting old VPN local accounts with password-only authentication methods, according to a blog post released Monday.
- The company has been monitoring attempts to gain unauthorized access to these accounts following months of high-profile attacks in the U.S. and elsewhere involving threat groups hacking into remote access VPN environments.
- Check Point said it assembled a team of incident response, product and technical service experts and determined a few other customers that were targeted by similar methods. As of Friday a total of three attempts have been identified globally, however the company continues to investigate and will provide updates when additional information is learned.
Dive Insight:
The attacks on Check Point customers follow months of threat activity targeting organizations that use VPN devices for secure remote access.
State-linked threat groups have targeted a number of vendors, exploiting critical vulnerabilities in attacks against organizations using edge devices.
As previously reported, vendors including Cisco and Ivanti, and others have been targeted in recent months by hackers targeting organizations that use vulnerable edge devices.
Volt Typhoon, a threat group linked to the People’s Republic of China, has also been linked to extensive targeting of critical infrastructure in the U.S.
Check Point Software Chief of Staff Gil Messing said the company sent a letter to customers last week about the attacks and the company will provide additional updates as it learns more information.
“Old, unused accounts with password only are an unrecommended cyber hygiene habit,” Messing said.
The company released a hotfix that customers can download in order to block this type of activity.
The company declined to provide specifics about where the customers are located, but said government cybersecurity authorities have been notified about the incidents.
