The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a emergency directive ordering federal agencies to mitigate an Pulse Connect Secure vulnerability by Friday.
CISA issued the Emergency Directive (ED) 21-03 Tuesday after Pulse Secure confirmed a FireEye report saying that at least two state-backed threat groups exploited the bug (tracked as CVE-2021-22893) to breach government and defense organizations in the US and across the globe.
As CISA explained, attackers exploit this vulnerability in conjunction with older ones to gain persistent system access and take over enterprise networks with vulnerable PCS devices.
Agencies told to check for compromise signs every day
Until the mitigation measures are applied, Federal Civilian Executive Branch departments and agencies were also told to run the Pulse Connect Secure Integrity Tool on all PCS appliances every 24 hours to check for evidence of compromise.
“This tool checks the integrity of the file system and detects any mismatch of hashes,” CISA said. “Adversaries are known to maintain persistence over upgrade cycles, and it is critical to run the tool even if all updates have already been deployed and the appliance is running the latest version of software.”
If any signs of malicious activity are found, CISA instructed the agencies to isolate the appliances and reach out to Pulse Secure to collect forensic evidence of the intrusion.
The agencies have to take remediation measures for all affected appliances and return them to production only after forensic artifacts have been harvested and analysis has been completed.