Critical Zero-Day Exploit in Popular VPN Software Exposes Thousands of Organizations A newly discovered zero-day vulnerability in Pulse Secure VPN, a widely used enterprise virtual private network solution, has left thousands of organizations exposed to potential cyberattacks. The flaw, tracked as CVE-2024-21887, allows unauthenticated attackers to execute arbitrary code remotely on vulnerable systems, granting full control over affected servers. Security researchers at ShadowServer Foundation first identified the exploit in late January 2024, warning that threat actors were actively scanning for unpatched Pulse Secure VPN appliances. The vulnerability affects versions 9.1R11.4 and earlier, with evidence suggesting exploitation attempts as early as December 2023. By mid-February, over 12,000 exposed instances were detected globally, with the highest concentrations in the U.S., Japan, and Germany. The exploit leverages a command injection flaw in Pulse Secure’s web interface, enabling attackers to bypass authentication and deploy malware, exfiltrate data, or move laterally within compromised networks. While Ivanti (Pulse Secure’s parent company) released an emergency patch on February 5, 2024, many organizations remain unprotected due to delayed updates. Cybersecurity firm Mandiant reported that state-sponsored hacking groups, including those linked to China and Russia, have already weaponized the vulnerability in targeted espionage campaigns. The incident underscores the risks of unpatched critical infrastructure, particularly in sectors like government, healthcare, and finance, where Pulse Secure VPN is heavily deployed. Organizations that fail to apply the patch risk data breaches, ransomware attacks, or persistent network compromise. As of the latest scans, nearly 30% of exposed systems remain unpatched, leaving them vulnerable to ongoing exploitation.

Storm-2561 Credential Theft Campaign Exploits SEO to Target Enterprise VPN Users Since May 2025, the financially motivated threat actor Storm-2561 has been conducting a credential theft campaign by manipulating search engine rankings to distribute fake VPN software. The operation targets employees searching for tools like Pulse Secure, Fortinet, and Ivanti, redirecting them to spoofed websites that deliver malicious download packages. Victims who install the fake software unknowingly expose their VPN credentials, which are silently harvested and sent to attacker-controlled servers. The campaign leverages SEO poisoning to push fraudulent sites to the top of search results for queries such as “Pulse VPN download.” These sites mimic legitimate vendor portals, complete with logos and download buttons, while hosting malicious ZIP files on GitHub repositories since removed. The trojans were digitally signed with a certificate issued to “Taiyuan Lihua Near Information Technology Co., Ltd.”, which has since been revoked. Microsoft Defender Experts identified the campaign in mid-January 2026, attributing it to Storm-2561 based on its history of malware distribution through SEO abuse and software impersonation. After credential theft, the fake VPN client displays a convincing error message before redirecting the victim to the official vendor website, ensuring no visible signs of compromise. The attack delivers its payload via a Windows Installer (MSI) package disguised as a legitimate Pulse Secure installer, dropping malicious DLL files (dwmapi.dll and inspector.dll) that function as an in-memory loader and a variant of the Hyrax infostealer. The malware exfiltrates credentials to 194.76.226[.]93:8080 and maintains persistence via the Windows RunOnce registry key. The campaign extends beyond Pulse Secure, with additional fake installers for GlobalProtect VPN and Sophos Connect discovered under the same certificate. Stolen credentials enable lateral movement within corporate networks, unauthorized data access, and follow-on attacks, posing a significant risk to enterprises relying on VPNs for remote operations. The attack’s sophistication combining realistic spoofing, legitimate-looking signatures, and post-compromise redirection makes detection particularly challenging.