Connect with us

Hi, what are you looking for?


Identity & Access

Check Point VPNs Targeted to Hack Enterprise Networks

Check Point is warning customers that threat actors are targeting insecure VPN instances for initial access to enterprise networks. 

Cybersecurity firm Check Point is advising customers to review their VPN configurations to ensure that they cannot be abused by threat actors for initial access to enterprise networks.

Check Point says it has seen VPNs from various cybersecurity vendors being targeted by threat actors. 

The company has been monitoring attempts to gain access to customers’ VPNs and identified “a small number of login attempts” that leveraged old VPN local accounts with password-only authentication. The attacks do not appear to involve the exploitation of a software vulnerability.

“We have assembled special teams of Incident Response, Research, Technical Services and Products professionals which thoroughly explored those and any other potential related attempts,” the company said in an alert on Monday.

“Relying on these customer notifications and Check Point’s analysis, the teams found within 24 hours a few potential customers which were subject to similar attempts,” it added. 

Check Point has instructed customers not to rely on password-only authentication for remotely accessing their networks. 

The vendor has advised organizations to review the use of local accounts and disable them if not needed. If they are needed, authentication should be made more secure, for instance, by adding an additional layer of authentication on top of passwords, such as certificates. 

Check Point VPN users should deploy the product on security gateways to prevent unauthorized access through password-only authentication.

Advertisement. Scroll to continue reading.

The company has provided a script that enables users to easily discover local accounts with password-only authentication, as well as a hotfix to block local accounts from authenticating with only a password.

Check Point has also provided general recommendations for improving an organization’s VPN security posture, and outlined instructions for investigating suspicious activity. 

Related: New ‘TunnelVision’ Technique Leaks Traffic From Any VPN System

Related: Cisco: Multiple VPN, SSH Services Targeted in Mass Brute-Force Attacks

Related: Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.


Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.


People on the Move

SaaS security company AppOmni has hired Joel Wallenstrom as its General Manager.

FTI Consulting has appointed Brett Callow as Managing Director in its Cybersecurity & Data Privacy Communications practice.

Mobile security firm Zimperium has welcomed David Natker as its VP of Global Partners and Alliances.

More People On The Move

Expert Insights