CISA gives US federal agencies three days to fix a VPN bug being attacked by a ransomware gang

A ransomware group is actively exploiting an unpatched flaw in security tools used across the US federal government, prompting US cybersecurity agency CISA to order all civilian agencies to address the vulnerability by the end of Wednesday.

Cybersecurity firm Check Point Software said the flaw affects several remote access tools, firewalls, and virtual private networks, which act as digital gatekeepers to protect company networks from unauthorized access.

The company said in a separate blog post that it had confirmed that the flaw had been exploited by a known ransomware group called Qilin to compromise “a few dozen targeted organizations globally” that relied on the affected security tools.

The hacks began on May 7, but activity began to pick up last week, according to Check Point.

Given the risks to the network of federal government organizations, CISA on Monday ordered all civilian federal agencies — such as Homeland Security, State and Treasury — to fix any instances in which agencies used the affected products by the end of June 11. The agency cited BOD Operational Guidance Memorandum 22-01 that allows it to direct agencies to take security actions when there is an active cyber threat to government networks.