Pierluigi Paganini
September 08, 2023
Cisco warns that a zero-day vulnerability (CVE-2023-20269) in Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) is actively exploited by ransomware groups to gain initial access to corporate networks.
An unauthenticated, remote attacker can exploit the vulnerability to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.
“This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials.” reads the advisory published by the IT giant. “A successful exploit could allow the attacker to achieve one or both of the following:
The company explained that the zero-day vulnerability was exploited by ransomware groups, such as the Akira ransomware gang, to target organizations.
At the end of August, Cisco revealed that it was aware of attacks conducted by Akira ransomware threat actors targeting Cisco ASA VPNs that are not configured for multi-factor authentication.
Cisco has been actively investigating the hacking campaign with the help of Rapid7. Rapid7 researchers have observed increased threat activity targeting Cisco ASA SSL VPN appliances dating back to at least March 2023.
“Rapid7 identified at least 11 customers who experienced Cisco ASA-related intrusions between March 30 and August 24, 2023.” reads report published by Rapid7.
Threat actors are conducting credential stuffing and brute-force attacks targeting Cisco ASA (Adaptive Security Appliance) SSL VPNs.
The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate. Like other ransomware gangs, the group has developed a Linux encryptor to target VMware ESXi servers.
The group now is targeting Cisco VPN products to gain initial access to corporate networks.
Sophos researchers observed in May the threat actor using compromised Cisco VPN accounts to breach target networks.
Bleeping Computer reported the information shared by the incident responder as ‘Aura’ on Twitter. Aura confirmed that threat actors targeted organizations using CISCO VPN appliances without MFA enabled.
BleepingComputer also reported that SentinelOne is investigating the possibility that the Akira ransomware group is exploiting an unknown vulnerability in the Cisco VPN software.
Cisco has yet to address CVE-2023-20269, waiting for a fix the company recommends:
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Cisco ASA)
