This new vulnerability was exploited, alongside a number of known Pulse Secure vulnerabilities, as the initial infection vector in these attacks. FireEye said this group was attempting to leverage the vulnerability in attacks targeting defense industrial base (DIB) targets in the U.S. On the same day, FireEye published a blog detailing how the vulnerability ( CVE-2021-22893) was being exploited by a China-linked APT group it tracks as UNC2630. On April 20, 2021, Pulse Secure published an advisory warning about a zero-day remote code execution vulnerability in its popular VPN product. Recent zero-day vulnerability in Pulse Secure VPN (CVE-2021-22893)

However, recently, there have been some more notable examples of attacks that attempt to either bypass MFA, or eradicate the need to bypass it at all, with five of these outlined in this blog. While MFA has perhaps only gained wide adoption in the last couple of years, attacks attempting to bypass MFA date as far back as 2011, when RSA Security was forced to replace 40 million SecurID tokens - which were used for MFA at the time - after the company was hacked.

When we look at recent high-profile attacks, such as SolarWinds, the Microsoft Exchange Server ProxyLogon attacks, and the vulnerabilities found in Pulse Secure VPN recently, all these attacks help attackers avoid the hurdle of needing to overcome MFA. The increasing use of MFA means that attackers have had to endeavor to find ways to bypass it, or avoid carrying out attacks that may be stalled by it. This means that, for attackers, stealing credentials or brute forcing passwords is no longer enough - if they don’t have access to victims’ multi-factor access token or code they will still not be able to access their accounts. This led to the wide adoption of MFA - from corporate accounts to social media profiles, almost all provide the option of enabling MFA, with many requiring it. In recent years two-factor or multi-factor authentication (MFA) has been touted as the way to protect your personal and business accounts from attack.

Checkpoint vpn 2fa