AA20-258A: Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity

CVE-2019-11510: Pulse Secure VPN Servers

CISA has conducted multiple incident response engagements at Federal Government and commercial entities where the threat actors exploited CVE-2019-11510—an arbitrary file reading vulnerability affecting Pulse Secure VPN appliances—to gain access to victim networks.

Although Pulse Secure released patches for CVE-2019-11510 in April 2019, CISA observed incidents where compromised Active Directory credentials were used months after the victim organization patched their VPN appliance.

CISA also observed the threat actors scanning for known vulnerable network appliance CVE-2019-11510.

CVE-2019-11510

CVE-2019-19781: Citrix Virtual Private Network (VPN) Appliances

CVE-2019-19781 enabled the actors to execute directory traversal attacks.

CISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers.

CVE-2019-19781

Exploited Vulnerabilities CISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902 CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781 CISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching GitHub Exploit-DB What is Mimikatz: The

CVE-2020-5902: F5 Big-IP Vulnerability

CISA has conducted incident response engagements at Federal Government and commercial entities where the threat actors exploited CVE-2020-5902.

CVE-2020-5902

F5 Security Advisory: K52145254: TMUI RCE vulnerability CVE-2020-5902

Database CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities CISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902 CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781 CISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching

CVE-2020-0688: Microsoft Exchange Server

CISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks.

Within weeks of public disclosure of CVE-2020-0688, CISA analysts identified traffic that was indicative of Chinese MSS-affiliated threat actors attempting to exploit this vulnerability using the Collection [TA0009] technique listed in table 10.

CISA observed the actors targeting CVE-2020-0688 to collect emails from the exchange servers found in Federal Government environments.

CVE-2020-0688

CISA has observed the actors leveraging CVE-2019-19781 to compromise Citrix Application Delivery Controllers.