Loading story…
Sen. Ron Wyden called on the National Security Agency to update federal cybersecurity guidance for virtual private networks (VPNs), highlighting the continued importance of securing remote-access infrastructure used to reach protected government and enterprise networks.
The existing NSA and CISA guidance, Selecting and Hardening Remote Access VPN Solutions, warns that nation-state actors can exploit VPN vulnerabilities for credential theft, remote code execution, session hijacking, cryptographic weakening, and disclosure of sensitive device data. It recommends using validated VPN products, enforcing strong multi-factor authentication, promptly applying patches, and disabling unnecessary non-VPN features to reduce attack surface.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
U.S. Senator Ron Wyden called on the NSA to update federal cybersecurity guidance concerning VPNs.
NSA and CISA jointly released the Cybersecurity Information Sheet “Selecting and Hardening Remote Access VPN Solutions.” The guidance recommends validated VPN products, multi-factor authentication, prompt patching, and disabling unnecessary features.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
wyden.senate.gov
Open sourcensa.gov
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sen. Ron Wyden asked the National Security Agency to update public guidance on commercial VPNs, warning that conventional single-hop services may not protect users against sophisticated foreign surveillance. A Congressional Research Service analysis requested by Wyden found that an adversary with broad internet-traffic visibility could correlate the timing and volume of encrypted traffic entering and leaving a VPN, linking users to websites without decrypting their communications. Wyden requested an unclassified NSA response by October 14 and called for clearer advice for government personnel, defense contractors, journalists, human-rights defenders, and other likely espionage targets. He asked the agency to assess multi-hop privacy technologies—including Tor, Nym, mixnets, and Apple iCloud Private Relay—against single-hop VPNs; CRS said such architectures can make correlation harder by separating a user's identity from the destination, but do not guarantee anonymity. Current NSA and CISA guidance largely focuses on securing remote-access VPN products from intrusion rather than surveillance through bulk traffic analysis.
Sep 3, 2026
A research paper from the Blekinge Institute of Technology in Sweden documented a 238% increase in attacks targeting virtual private networks (VPNs) between 2020 and 2022, coinciding with the rapid expansion of remote work during the COVID-19 pandemic. The study, which analyzed 81 reports from sources such as Google and BrightTALK, found that organizations rushed to deploy VPNs to support a growing remote workforce, often without adequate security controls or preparation. This led to widespread vulnerabilities, including exposed gateways, misconfigurations, and unpatched systems, which threat actors exploited to gain unauthorized access and move laterally within corporate networks. Researchers concluded that many new VPN users lacked essential endpoint controls and network segmentation, making it easier for attackers to compromise entire environments. Security experts noted that while VPNs are not inherently difficult to secure, the unprecedented pace of adoption and lack of experience among organizations significantly increased the attack surface. The findings highlight the critical need for robust VPN security practices, especially in environments with rapidly changing remote access requirements.
Jun 29, 2026
Ransomware affiliates mounted a coordinated wave of attacks against internet-facing VPN and firewall appliances from **Palo Alto Networks, Fortinet, Check Point, and Citrix**, turning edge remote-access systems into a primary entry point for corporate intrusions. Reported campaigns included **FortiBleed** credential exposure on FortiGate devices, exploitation of Palo Alto GlobalProtect authentication bypass `CVE-2026-0257`, abuse of Check Point VPN authentication bypass `CVE-2026-50751`, and rapid exploitation of Citrix NetScaler memory-disclosure flaw `CVE-2026-8451`. Security reporting linked **Qilin** affiliates to at least the Palo Alto and Check Point activity, with exploitation beginning within days—and in some cases less than 24 hours—after disclosure or proof-of-concept release. After gaining access, attackers were reported using lateral movement and credential-theft techniques including **Impacket, NTLM relay, Mimikatz, PsExec, RDP, WMI**, Chrome credential theft via GPO, and **WSL-based EDR evasion**, followed by data theft and double-extortion ransomware deployment. Victims were concentrated in the United States, United Kingdom, Australia, and Western Europe across healthcare, education, manufacturing, local government, media, professional services, and critical infrastructure. The surge prompted Sen. **Ron Wyden** to call for a federal purge of legacy, public-facing VPNs, urging **OMB, CISA, and NIST** to push agencies toward zero-trust remote access and away from perimeter-based systems repeatedly exposed by incidents involving Fortinet, Check Point, Ivanti, and Cisco platforms.
Jul 27, 2026