VPN brute force attacks: Your logs are full of them (guaranteed)

https://www.bleepingcomputer.com/news/security/cisco-warns-of-large-scale-brute-force-attacks-against-vpn-services

Make sure you are using MFA for every account that has remote access and check all remote access points; not just VPNs.

Ivanti Connect Secure/Pulse Secure

If you are not caught up on patches, get so quickly. In addition to password spraying, we are seeing a large pickup in exploit attempts. The most recent version is Release 9.1R18.2 PRs. You can find the notes here: https://help.ivanti.com/ps/help/en_US/ICS/9.1RX/rn-9.1R18.2/fixed-issues.htm. It was only May, 2021 when actors were exploiting zero-days. The impact of that vulnerability caused Pulse Secure to release an Integrity Tool to check if files had been modified on the appliances.

Now might be a good time to refamiliarize yourself with the tool if you are not familiar https://forums.ivanti.com/s/article/KB44755?language=en_US

Ivanti Best Practices Guide https://forums.ivanti.com/s/article/KB29805?language=en_US&kA1j0000000Fil5=

If you haven’t patched GoAnywhere Managed File Transfer (MFT) do it right now (Though it might be too late).

https://www.securityweek.com/goanywhere-zero-day-attack-hits-major-orgs/

SSL-VPN zero-day vulnerability

Anyone else seeing other impacted products? What else is vulnerable to ” heap-based buffer overflow vulnerability [CWE-122]”

PSIRT Advisory: Patch FortiOS SSL-VPN ASAP

https://www.fortiguard.com/psirt/FG-IR-22-398

JIT for Black Friday shopping: FBI releases tips to help protect your systems, your data and your money safe

https://www.fbi.gov/how-we-can-help-you/safety-resources/scams-and-safety/on-the-internet

Credential stuffing attacks are using residential proxies (hacked devices)

https://www.bleepingcomputer.com/news/security/fbi-warns-of-residential-proxies-used-in-credential-stuffing-attacks/

Cisco: Upgrade (replace) EoL VPN devices

Cisco tells customers to upgrade VPN routers or risk attack (msn.com)

CISA/FBI/ACSC/NCSC release joint advisory concerning vulnerabilities in Fortinet and Microsoft Exchange products. These are not new vulnerabilities but remain exploited

https://www.bleepingcomputer.com/news/security/us-uk-warn-of-iranian-hackers-exploiting-microsoft-exchange-fortinet/

FBI advised that it is aware an APT exploited a Zero-day in FatPipe MPVPN servers for 6 months but don’t name the actor. Patch released.

https://therecord.media/fbi-an-apt-abused-a-zero-day-in-fatpipe-vpns-for-six-months/