Monday briefing: Ransomware crews still exploiting edge VPNs, defenders urged to patch PAN‑OS GlobalProtect and Ivanti now
Marcus Webb ·
Ransomware affiliates are again leaning on unpatched VPN and gateway appliances as initial access, with Palo Alto Networks PAN OS GlobalProtect CVE 2024 3400 and Ivanti Connect Secure flaws still under active exploitation as of Monday. Leak site monitoring and late week advisories indicate campaigns continued over the weekend against enterprises in North America and Europe. Security teams should prioritize patching edge devices and hunting for persistence before business hours ramp up.
This matters because these appliances sit outside typical endpoint telemetry and grant direct network access once compromised. CISA keeps CVE 2024 3400, Ivanti CVE 2023 46805 and CVE 2024 21887, and Citrix NetScaler CVE 2023 4966 on its Known Exploited Vulnerabilities list, and affiliates tied to LockBit and Akira have repeatedly abused these vectors for lateral movement and encryption.
Edge devices remain the soft spot
Recent intrusions follow a consistent pattern, attackers obtain code execution on the VPN or gateway, disable or tamper with logging, drop web shells, and create rogue administrative accounts. From there they harvest credentials and pivot to vSphere, Hyper V, and backup servers, then stage data theft and file encryption. Victims that appear on leak sites after such access commonly include manufacturing suppliers, regional healthcare, and local government.
For PAN OS CVE 2024 3400, defenders should move to fixed releases from Palo Alto Networks and review configuration archives for unexpected admin users, opaque scheduled tasks, and unknown system extensions. For Ivanti Connect Secure, apply vendor hotfixes, run the Integrity Checker Tool, and inspect for unauthorized files and web shells on the appliance filesystem. For Citrix NetScaler CVE 2023 4966, patch and invalidate all active sessions to clear hijacked tokens.
Immediate actions for Monday
Restrict management interfaces on all edge appliances to a management network or VPN only. Enforce multifactor authentication on remote access, rotate VPN pre shared keys, and rotate SAML certificates and OAuth app secrets that may have been exposed. Review authentication logs for new source autonomous system numbers, impossible travel, and disabled logging events.
Hunt internally for lateral movement from the gateway, check for recent connections to vCenter APIs, backup admin consoles, and SMB shares from accounts that normally do not access them. Isolate and reimage compromised appliances rather than relying on point in time cleanup, then reset credentials that traverse those devices.
The continued pressure on edge infrastructure highlights how appliance centric access and legacy authentication leave gaps that EDR and zero trust controls do not cover by default. Vendors and buyers are being pushed toward designs that expose fewer services to the internet, ship with stronger default hardening, and support continuous integrity checks for devices that cannot run traditional agents.