Black Kingdom ransomware hacks networks with Pulse VPN flaws

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/black-kingdom-ransomware-hacks-networks-with-pulse-vpn-flaws/

Operators of Black Kingdom ransomware are targeting enterprises with unpatched Pulse Secure VPN software or initial access on the network, security researchers have found.
The malware got caught in a honeypot, allowing researchers to analyze and document the tactics used by the threat actors.

Modus operandi

They’re exploiting CVE-2019-11510, a critical vulnerability affecting earlier versions of Pulse Secure VPN that was patched in April 2019. Companies delayed updating their software even after exploits became public, prompting multiple alerts from the U.S. government and threat actors started leveraging it; some organizations continue to run a vulnerable version of the product.
... ...

 

[upnorth]

Issue with Pulse Secure VPN, is the same that happened for example in the Travelex case. Check " Similar threads " below for more.

Good catch on the Ransomware by the Redteam.pl.