Huntress Urges VPN Hardening After Intrusions Exploited Weak Authentication and Access Controls
Summary
Huntress describes intrusions involving compromised VPN access and urges organizations to enforce MFA, restrict privileges, disable unused accounts, centralize logs, and monitor suspicious logins.
Key points
- Huntress says roughly 70% of active intrusions its SOC catches begin with attackers authenticating through VPN access.
- In one case, an attacker used a compromised FortiGate VPN, ran reconnaissance commands, and staged publicly available BlueHammer, RedSun, and UnDefend tools.
- In another incident, an attacker authenticated to a VPN, mapped the environment, and attempted to deploy Play ransomware; EDR and SOC response stopped encryption.
- A separate SonicWall SSLVPN intrusion involved compromised credentials, no MFA or segmentation, administrative access, network discovery, and BYOVD tactics.
- Huntress says missing or uncentralized VPN logs can leave investigators without the initial intrusion timeline.
- Recommended steps include enforcing MFA, auditing privileged access, disabling unused accounts, centralizing logs, and monitoring login anomalies.
Article Details
- Defense Focus
- Detect and contain intrusions that begin with compromised VPN access, while improving visibility and reducing the impact of unauthorized access.
- Detection Methods
- Correlate VPN authentication events with subsequent endpoint activity and hands-on-keyboard commands; alerts alone may not reveal the full sequence.
- Monitor VPN logins for anomalies and investigate successful authentications that lack expected security controls.
- Look for unusual binaries in user folders, including Pictures and Downloads, and investigate suspicious execution and activity.
- Review activity such as whoami /priv, cmdkey /list, net group, ping sweeps, and attempts to enumerate or disable security tools.
- Use managed EDR and Defender alerts to identify and respond to suspicious endpoint activity.
- Data Sources
- VPN authentication logs, including successful authentication events and source IPs
- Endpoint telemetry and security alerts
- Command execution and network discovery activity
- Centralized SIEM logs to preserve an investigation timeline
- Platforms
- Huntress Managed SIEM
- Managed EDR
- Microsoft Defender
- Windows Defender
- Defensive Actions
- Enforce MFA for VPN access.
- Audit privileged accounts and remove unnecessary administrative rights.
- Disable legacy and unused accounts.
- Centralize and retain VPN logs.
- Monitor for login anomalies, enforce allow/deny lists, and use strong, unique passwords.
- Segment networks and accounts to limit the impact of compromised credentials.
MITRE ATT&CK
T1018 · Remote System DiscoveryIn the SonicWall SSLVPN incident, the attacker conducted network discovery using ping sweeps.T1033 · System Owner/User DiscoveryThe article reports the command whoami /priv during post-entry enumeration.T1069.002 · Domain GroupsThe article reports the command net group as part of post-entry enumeration.T1133 · External Remote ServicesThe incidents described begin with attackers authenticating through VPN access, including compromised FortiGate VPN access and SonicWall SSLVPN credentials.T1555.004 · Windows Credential ManagerThe article reports cmdkey /list during post-entry enumeration of credentials.T1562.001 · Disable or Modify ToolsIn the SonicWall SSLVPN incident, the attacker used BYOVD tactics to enumerate security tools and disable defenses.
People
Malware
Vendors
Huntressteam in those organizations is probably small and doing its best to prioritize. According to the Huntress How to Build a Resilient Security Team for 2030 field guide, the common sizes for IT and security teamsMicrosoftWhat stopped it was timing. Managed Endpoint Detection and Response (EDR) and Managed Microsoft Defender fired off fast warning signals, and our SOC analysts jumped in before encryption had a chance.SonicWallIn another case, a threat actor compromised SonicWall SSLVPN credentials and landed inside the target environment with administrative privileges that were handed to them on a silver platter by two compounding gaps: no
Products
Fortinet FortiGatefiguring out what they had to work with. As for how they got in the door initially? A compromised FortiGate VPN.Huntress Managed SIEMFigure 2: Huntress Managed SIEM dashboard showing VPN successful authentication events from the threat actor’s IPMicrosoft Defender Antimalware PlatformWhat stopped it was timing. Managed Endpoint Detection and Response (EDR) and Managed Microsoft Defender fired off fast warning signals, and our SOC analysts jumped in before encryption had a chance.SonicWall SSL VPNIn another case, a threat actor compromised SonicWall SSLVPN credentials and landed inside the target environment with administrative privileges that were handed to them on a silver platter by two compounding gaps: noWindows DefenderWindows Defender detected and blocked BlueHammer first, which was followed by sketchy RedSun activity a few days later. But the attacker wasn't counting on Defender alone to fail. They were counting on getting enough
Tools
BlueHammerThis blog was updated on April 17 to include threat activity we’re observing with Nightmare-Eclipse's BlueHammer, RedSun, and UnDefend exploitation techniques.RedSunThis blog was updated on April 17 to include threat activity we’re observing with Nightmare-Eclipse's BlueHammer, RedSun, and UnDefend exploitation techniques.UnDefendThis blog was updated on April 17 to include threat activity we’re observing with Nightmare-Eclipse's BlueHammer, RedSun, and UnDefend exploitation techniques.