5 August 2020

Hacker published passwords for over 900 corporate VPN servers


Hacker published passwords for over 900 corporate VPN servers
A hacker posted on a Russian-speaking forum a list of usernames and passwords, along with IP addresses for more than 900 corporate Pulse Secure VPN servers.

ZDNet confirmed the authenticity of the data and reported, that the list includes IP addresses of Pulse Secure VPN servers, firmware version of Pulse Secure VPN server, SSH keys for each server, a list of all local users and their password hashes, administrator account details, VPN session cookies, etc.

The list was discovered by the Bank Security, a threat intelligence analyst specialized in financial crime. According to the expert, all Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability.

The expert believes that hacker who compiled this list scanned the entire internet IPv4 address space for Pulse Secure VPN servers, used an exploit for the CVE-2019-11510 vulnerability to gain access to systems, dump server details (including usernames and passwords), and then collected all the information in one central repository.

The list was published on a hacker forum, which is often visited by ransomware operators. For example, REvil (Sodinokibi), NetWalker, Lockbit, Avaddon, Makop and Exorcist have threads on the same forum, and use it to recruit members (developers) and affiliates (customers).

Back to the list

Latest Posts

Healthcare provider UHS hit by a ransomware attack

Healthcare provider UHS hit by a ransomware attack

The cause of the incident is believed to be the Ryuk ransomware.
29 September 2020
Apple fixed four dangerous vulnerabilities in macOS

Apple fixed four dangerous vulnerabilities in macOS

Exploitation of some of the problems allows arbitrary code execution on the system.
28 September 2020
200,000 Businesses are exposed to MitM attacks

200,000 Businesses are exposed to MitM attacks

A successful attack could allow an attacker to present a valid SSL certificate and fraudulently take over a connection.
25 September 2020