Cybersecurity company Check Point Software Technologies Ltd. is warning that it’s seeing a rise in threat actors exploiting remote-access virtual private network environments to gain authorized access to enterprises.

Over the last few months, Check Point researchers have observed malicious groups leveraging VPNs as an entry point and attack vector into organizations. The groups aim to discover enterprise assets and users, seeking vulnerabilities to gain persistence on key assets.

Check Point more recently identified a small number of login attempts using old VPN local accounts relying on password-only authentication. It likely goes without saying that password-only authentication is considered insecure.

The researchers also identified a vulnerability in Check Point Network Security gateways that potentially allows an attack to read certain information on internet-connected Check Point gateways with remote access VPN or mobile access enabled.

Check Point has released a solution to address the vulnerability, which all customers using Check Point Network Security gateways are advised to implement.

Patrick Tiquet, vice president of Security and Architecture at cybersecurity company Keeper Security Inc., told SiliconANGLE that the warning from Check Point is a reminder that threat actors are continually evolving their tactics, highlighting the need for enterprises to be more proactive against cyberthreats.

“Attackers exploiting old, insecure local accounts is a reminder that security is an ongoing process, and enterprises must continually update their authentication methods to ensure they are in line with the latest best practices,” Tiquet said. “Enterprises must adopt a layered security approach that includes strong authentication methods, regular security assessments and timely application of security patches.”

Jason Soroko, senior vice president of product at certificate management solutions company Sectigo Ltd., said switching to stronger authentication has multiple benefits. “Many of today’s enterprise applications already actively support modern alternatives to passwords, by offering certificate-based authentication as the de-facto technology to replace passwords for humans and machines,” he said.

Image: SilicoANGLE/GPT-4o