Cybersecurity firm Check Point is advising customers to review their VPN configurations to ensure that they cannot be abused by threat actors for initial access to enterprise networks.
Check Point says it has seen VPNs from various cybersecurity vendors being targeted by threat actors.
The company has been monitoring attempts to gain access to customers’ VPNs and identified “a small number of login attempts” that leveraged old VPN local accounts with password-only authentication. The attacks do not appear to involve the exploitation of a software vulnerability.
“We have assembled special teams of Incident Response, Research, Technical Services and Products professionals which thoroughly explored those and any other potential related attempts,” the company said in an alert on Monday.
“Relying on these customer notifications and Check Point’s analysis, the teams found within 24 hours a few potential customers which were subject to similar attempts,” it added.
Check Point has instructed customers not to rely on password-only authentication for remotely accessing their networks.
The vendor has advised organizations to review the use of local accounts and disable them if not needed. If they are needed, authentication should be made more secure, for instance, by adding an additional layer of authentication on top of passwords, such as certificates.
Check Point VPN users should deploy the product on security gateways to prevent unauthorized access through password-only authentication.
The company has provided a script that enables users to easily discover local accounts with password-only authentication, as well as a hotfix to block local accounts from authenticating with only a password.
Check Point has also provided general recommendations for improving an organization’s VPN security posture, and outlined instructions for investigating suspicious activity.
Related: New ‘TunnelVision’ Technique Leaks Traffic From Any VPN System
Related: Cisco: Multiple VPN, SSH Services Targeted in Mass Brute-Force Attacks
Related: Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability
