NSA Releases List of Top 5 vulnerabilities

The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) jointly released a Cybersecurity Advisory, warning that Russian APT operators are exploiting five known and already patched vulnerabilities incorporate VPN infrastructure products, insisting it is “critically important” to mitigate these issues immediately.

The warning was issued to call attention to a quintet of CVEs that are being actively exploited by a threat actor affiliated with Russia’s foreign intelligence service (SVR).

Russian Foreign Intelligence Service (SVR) actors (also known as APT29, Cozy Bear, and The Dukes) frequently use publicly known vulnerabilities to conduct widespread scanning and exploitation against vulnerable systems to obtain authentication credentials to allow further access.

This targeting and exploitation encompass U.S. and allied networks, including national security and government-related systems.

Recent Russian SVR activities include compromising SolarWinds Orion software updates, targeting COVID-19 research facilities through deploying WellMess malware, and leveraging a VMware vulnerability that was a zero-day at the time for follow-on Security Assertion Markup Language (SAML) authentication abuse.

SVR cyber actors also used authentication abuse tactics following SolarWinds-based breaches.

Mitigation against these vulnerabilities is critically important as the U.S. and allied networks are constantly scanned, targeted, and exploited by Russian state-sponsored cyber actors.

Five Vulnerabilities that need Immediate Attention

NSA Releases List of Top 5 vulnerabilities

The NSA’s decision to pinpoint the five old security flaws suggests that many organizations are slow to apply the available fixes, especially during the pandemic when work-from-home expanded the need for VPN technologies.

NSA, CISA, and FBI strongly encourage all cybersecurity stakeholders to check their networks for indicators of compromise related to all five vulnerabilities and to immediately implement associated mitigations.

NSA, CISA, and FBI also recognize all partners in the private and public sectors for comprehensive and collaborative efforts to respond to recent Russian activity in cyberspace.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Joe Biden Appointed two Former Senior NSA Officials for Senior Cyber Security Roles

Hackers Are Exploiting These Web Application Vulnerabilities to Install Persistent Backdoor – NSA

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.