Iran-Based Threat Actor Exploits VPN Vulnerabilities

CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.

CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.

The following file paths can be used to detect Tiny web shell, ChunkyTuna web shell, or Chisel if a network has been compromised by this attacker exploiting CVE-2019-19781.

As indicated in table 2, the threat actor primarily gained initial access by using the publicly available exploit for CVE-2019-19781.

If your organization has not patched for the Citrix CVE-2019-19781 vulnerability, and a compromise is suspected, follow the recommendations in CISA Alert AA20-031A.

CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781CISA Alert AA20-073A: Enterprise VPN SecurityCISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN PatchingCISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902CISA Security Tip: Securing Network Infrastructure Devices

CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.

CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781CISA Alert AA20-073A: Enterprise VPN SecurityCISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN PatchingCISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902CISA Security Tip: Securing Network Infrastructure Devices

CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902.

The following file paths can be used to detect Tiny web shell, ChunkyTuna web shell, or Chisel if a network has been compromised by this attacker exploiting CVE-2019-19781.