A hacker posted on a Russian-speaking forum a list of usernames and passwords, along with IP addresses for more than 900 corporate Pulse Secure VPN servers.

ZDNet confirmed the authenticity of the data and reported, that the list includes IP addresses of Pulse Secure VPN servers, firmware version of Pulse Secure VPN server, SSH keys for each server, a list of all local users and their password hashes, administrator account details, VPN session cookies, etc.

The list was discovered by the Bank Security, a threat intelligence analyst specialized in financial crime. According to the expert, all Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability.

The expert believes that hacker who compiled this list scanned the entire internet IPv4 address space for Pulse Secure VPN servers, used an exploit for the CVE-2019-11510 vulnerability to gain access to systems, dump server details (including usernames and passwords), and then collected all the information in one central repository.

The list was published on a hacker forum, which is often visited by ransomware operators. For example, REvil (Sodinokibi), NetWalker, Lockbit, Avaddon, Makop and Exorcist have threads on the same forum, and use it to recruit members (developers) and affiliates (customers).