Archive — US — techcrunch
CISA gives US federal agencies three days to fix a VPN bug under attack by aransomware gang
CISA has mandated U.S. federal agencies to rectify a VPN vulnerability exploited by the Qilin ransomware gang within three days, highlighting an immediate cybersecurity threat to government networks resulting from an unpatched flaw in widely-used security tools.
Key points
- A ransomware group called Qilin is exploiting a critical flaw in VPNs and security tools used by U.S. federal agencies.
- CISA issued a directive for all civilian agencies to remediate this vulnerability by June 11.
- The flaw affects products from Check Point Software, which protects networks from unauthorized access.
- The issue was confirmed to be actively exploited, with cyberattacks on 'dozens' of organizations globally starting on May 7.
- BOD 22-01 provided CISA the authority to enforce immediate security actions in response to cybersecurity threats.
Why it matters
- The Ongoing Rise of Ransomware: Ransomware attacks have significantly increased worldwide, with several notable incidents affecting both private and public sectors.
- Government Cybersecurity Measures: This incident underscores the evolving threat environment and the importance of robust cybersecurity frameworks for federal agencies.
- IT Trends by 2025: The increasing reliance on VPNs and remote access tools in a hybrid work environment heightens the need for timely updates and patches to mitigate vulnerabilities.
The urgency of CISA's directive underscores the heightened risks cyberattacks pose to government integrity, necessitating immediate and effective remediation to safeguard sensitive networks against evolving threats.