After FireEye released a blog post detailing its findings today, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency issued an alert saying it was aware of “ongoing exploitation” of Pulse Connect Secure that is “compromising US government agencies, critical infrastructure entities, and private sector organisations.”
The agency did not provide additional details about which organisations were breached.
Ivanti, the Utah-based owner of Pulse Connect Secure, said a limited number of customers “experienced evidence of exploit behaviour.”
The company said the hackers used three known exploits and a previously unknown one.
The company says it will release a patch in early May.
Charles Carmakal, the chief technology officer at FireEye, said it is still trying to piece together details about the hack but that available evidence suggests the hackers are aligned with the Chinese government.
Mr Carmakal, whose company discovered in December the months-long SolarWinds hacking campaign attributed to Russian cyberspies, said the Pulse Connect Secure hack had several notable aspects: The hackers were highly skilled, were able to evade multifactor authentication and could stay hidden on a penetrated network even if software was reset or upgraded.
“Their tradecraft is really good,” he said.
Neither FireEye nor Ivanti would specify who was targeted.
But Mr Carmakal said those hacked were government agencies in both the US and Europe as well as US-based defence companies “you would anticipate the Chinese government being interested in.”
“They’re very high-profile victims,” he said.
The Chinese Embassy did not immediately return a request for comment.
The new disclosure comes at a time of heightened interest in US cybersecurity defences.
US officials are still grappling with the aftereffects of the SolarWinds intrusion, which struck agencies including the Treasury, Justice and Homeland Security departments.
The breach exposed vulnerabilities in the supply chain as well as weaknesses in the federal government’s own cyber defences.
This content first appear on 9news