Exploitation of Remote Services in Cyber Attacks

Adversaries are increasingly leveraging external remote services like VPNs and Citrix to gain unauthorized access to networks. These attacks often involve using valid accounts obtained through credential harvesting or phishing. Notable incidents include the 2025 Poland Wiper Attacks, where threat actors exploited an exposed FortiGate VPN interface. Additionally, various APT groups, such as APT28 and APT29, have utilized remote services for persistence and lateral movement within compromised environments. The use of tools like ShadowLink to establish Tor hidden services for remote access has also been reported. Organizations are urged to implement multi-factor authentication and restrict unnecessary remote access to mitigate these threats. The ongoing nature of these attacks indicates a significant risk to enterprise networks.

Key Points: • Adversaries exploit remote services like VPNs and Citrix for unauthorized access. • Credential harvesting is a common method for obtaining valid accounts. • Implementing multi-factor authentication can help mitigate these threats.