Loading story…
Sen. Ron Wyden asked the National Security Agency to update public guidance on commercial VPNs, warning that conventional single-hop services may not protect users against sophisticated foreign surveillance. A Congressional Research Service analysis requested by Wyden found that an adversary with broad internet-traffic visibility could correlate the timing and volume of encrypted traffic entering and leaving a VPN, linking users to websites without decrypting their communications.
Wyden requested an unclassified NSA response by October 14 and called for clearer advice for government personnel, defense contractors, journalists, human-rights defenders, and other likely espionage targets. He asked the agency to assess multi-hop privacy technologies—including Tor, Nym, mixnets, and Apple iCloud Private Relay—against single-hop VPNs; CRS said such architectures can make correlation harder by separating a user's identity from the destination, but do not guarantee anonymity. Current NSA and CISA guidance largely focuses on securing remote-access VPN products from intrusion rather than surveillance through bulk traffic analysis.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Sen. Ron Wyden sent NSA Director Gen. Joshua Rudd a letter requesting revised public guidance and unclassified answers on whether single-hop commercial VPNs protect against sophisticated foreign traffic-surveillance adversaries. Wyden also released a Congressional Research Service analysis describing traffic-correlation risks and requested NSA's assessment of multi-hop systems such as Tor, Nym, and Apple iCloud Private Relay.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcescworld.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourcecyberscoop.com
Open sourcewyden.senate.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sen. Ron Wyden called on the National Security Agency to update federal cybersecurity guidance for virtual private networks (VPNs), highlighting the continued importance of securing remote-access infrastructure used to reach protected government and enterprise networks. The existing NSA and CISA guidance, *Selecting and Hardening Remote Access VPN Solutions*, warns that nation-state actors can exploit VPN vulnerabilities for credential theft, remote code execution, session hijacking, cryptographic weakening, and disclosure of sensitive device data. It recommends using validated VPN products, enforcing strong multi-factor authentication, promptly applying patches, and disabling unnecessary non-VPN features to reduce attack surface.
Sep 3, 2026
Sen. Ron Wyden and Rep. Greg Casar have asked the U.S. Government Accountability Office to investigate how federal agencies use hacking tools and spyware against Americans, seeking an unclassified public report on the scope, frequency, safeguards, and legal processes behind those operations. The request targets agencies including the FBI, DEA, ICE Homeland Security Investigations, and the Secret Service, and argues that federal law enforcement has used such capabilities for more than 25 years with far less transparency than exists for traditional wiretap authorities. The lawmakers asked the GAO to examine how agencies acquire and secure hacking tools, whether government personnel have misused them, what is disclosed to courts when warrants are sought, and how Rule 41 authorities are used for court-approved hacking. The push comes amid broader scrutiny of U.S. government spyware practices, including ICE's acknowledged work with spyware firm **Paragon**, and follows concerns that stolen government hacking tools have previously been repurposed by foreign adversaries against **Ukraine** and cryptocurrency users.
Aug 21, 2026
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from **Palo Alto Networks, Fortinet, Check Point, and Citrix**, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included **FortiBleed** credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass `CVE-2026-0257`, abuse of Check Point VPN authentication bypass `CVE-2026-50751`, and rapid exploitation of Citrix NetScaler memory-disclosure flaw `CVE-2026-8451`. Security reporting linked **Qilin** affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release. After gaining access, attackers were reported using lateral movement and credential-theft techniques including **Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI**, Chrome credential theft via GPO, and **WSL-based EDR evasion**, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. **Ron Wyden** to call for a federal purge of legacy, public-facing VPNs, urging **OMB, CISA, and NIST** to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Jul 27, 2026