Skip to content

Back to the catalog

Attackers Love Your VPN To-Do List
huntress.comarticle

Attackers Love Your VPN To-Do List

Huntress SOC writeup on VPN compromise as the dominant initial-access vector, citing that ~70% of intrusions their SOC catches begin with attacker authentication through VPN. It walks through real incidents: a compromised FortiGate VPN leading to deployment of publicly available GitHub tools BlueHammer, RedSun, and UnDefend (attributed to threat actor Nightmare-Eclipse); a VPN-originated Play ransomware attempt stopped by EDR; missing VPN logs hampering investigation; and a SonicWall SSLVPN credential compromise that led to BYOVD-based defense evasion due to missing MFA and account segmentation. It closes with a prioritized remediation checklist (enforce MFA, audit privileged accounts, disable legacy accounts, centralize logging).

TL;DR Huntress SOC data shows ~70% of caught intrusions start with VPN authentication abuse; case studies cover FortiGate/SonicWall compromises, BlueHammer/RedSun/UnDefend tooling from Nightmare-Eclipse, and a Play ransomware near-miss.
Open original ↗
Document

What it is

A Huntress SOC awareness blog (updated April 17) on VPN-initiated intrusions. Beyond the headline statistics the summary covers, the page gives concrete host-based artifacts from one FortiGate-VPN incident involving Nightmare-Eclipse's GitHub tools, and names the specific defensive gap that repeatedly breaks investigations.

How it works

Attackers authenticate through VPN as a legitimate user rather than exploiting a zero-day (Huntress notes they often find no evidence of appliance exploitation). Once inside, they run hands-on-keyboard enumeration, then stage and execute tooling from unusual user directories. In the observed case Windows Defender caught BlueHammer first; RedSun activity followed several days later — the attacker was betting on enough dwell time to escalate before the disparate alerts were connected.

Preconditions / Affected

VPN access reachable and authenticating without MFA (the post frames MFA as commonly deferred among small/underfunded orgs — medical, legal, construction, veterinary). Detection depends on EDR plus analysts correlating alerts; Defender alone blocked individual binaries but would not have told the full story.

What to do

The page offers hunt/detection artifacts rather than patches:

  • Enumeration sequence run before tool execution: `` whoami /priv cmdkey /list net group ``
  • Staging locations — binaries in places they don't belong: a low-privilege user's Pictures folder, and a two-letter subfolder inside Downloads.
  • Filenames flagged as tells: FunnyApp.exe, RedSun.exe, z.exe (BlueHammer / RedSun / UnDefend, attributed to Nightmare-Eclipse).
  • Preserve VPN logs centrally. Huntress repeatedly responds to VPN intrusions where the earliest evidence is already gone due to storage/rotation, forcing them to reconstruct a timeline "that starts halfway through." A SIEM (or equivalent centralized logging) is named as the fix so the intrusion's opening authentication event survives.
  • Close the underlying gap: enable MFA on VPN authentication.

Caveats

This is a vendor SOC blog, not an advisory — no CVE, no product version, no FortiGate patch. The tool names and paths are incident observations, not a formal IOC list, and filenames like z.exe are trivially changed. The 70% figure is a webinar quote from one vendor's SOC telemetry. The remediation content is generic (MFA, SIEM) and the concrete value here is the detection/hunt artifacts above.

Organisations named here

  • Nightmare-Eclipse
  • Play ransomware

Technologies named here

  • VPN
  • FortiGate
  • SIEM
  • EDR
  • Windows Defender
  • BlueHammer
  • RedSun
  • UnDefend
  • SonicWall

Techniques named here

  • BYOVD

Related in Threat Intel