How threat actors exploit remote work VPNs for initial access

Remote access VPNs have become a persistent target because they connect mobile employees, contractors and IT administrators to the systems they need. Many organisations treated these gateways as temporary pandemic infrastructure, then left them exposed as work became hybrid. Attackers are now scanning the public internet for remote access portals, testing weak passwords and known vulnerabilities, and buying credentials stolen from unrelated breaches.

Compromise does not always require sophisticated malware. A valid username and password can open a path into corporate file shares, identity systems and cloud administration. Some attackers skip password theft entirely by exploiting appliances before their owners install security updates. Others impersonate a worker to defeat multifactor authentication, steal an active session or persuade a help desk to reset access. The result is an initial-access route that looks authenticated and leaves little visible disruption.

Australian workers are a broad and attractive target. Remote staff in Sydney, Melbourne and Brisbane can use the same gateway as colleagues in regional towns, while small and medium-sized businesses account for roughly 96 per cent of Australian businesses and often depend on outsourced IT support. Customs brokers, freight operators and other organisations around the ports of Melbourne and Brisbane also rely on remote access for partners and after-hours administration.

The defensive priority is to reduce what attackers can reach without a login, contain the damage when credentials fail, and make every privileged session accountable. Patching, phishing-resistant multifactor authentication, reduced management exposure and rapid session revocation form the core of that approach. Gateway logs must connect with identity, endpoint and cloud records, because a suspicious IP address alone rarely explains the risk.

How the VPN perimeter is being breached

Attackers begin with discovery. Internet-wide scanning tools can identify VPN portals through IP addresses, certificates, protocol responses and default banners. The exposed surface may include the portal itself, administrative interfaces, forgotten test servers or a VPN account belonging to a former worker. Automated tools check these assets for missing patches, default credentials and endpoints that return information without authentication.

Credential attacks add a second front. Infostealer malware captures browser passwords and cookies from infected personal and company devices, while criminal markets sell access to corporate VPNs. Attackers combine those credentials with password spraying, geographic anomalies and carefully timed activity. On systems with multifactor authentication, they may request an approval through repeated notifications, abuse a forgotten recovery process or hijack an authenticated session.

A foothold is valuable mainly because it provides trusted connectivity. From there, attackers can enumerate internal hosts, collect directory data and reach cloud consoles that trust the corporate network. They may also alter VPN configurations or appliance firmware to preserve their route. A 2023 ASD-led warning about compromised Australian home routers showed the same principle on small devices: an attacker can use legitimate network access while avoiding malware and conspicuous command-and-control traffic.

Identity attacks make stolen access more powerful

The identity around the gateway matters as much as the appliance. An operation described in hijacking verified accounts illustrates how a trusted public identity can support convincing phishing and password-reset abuse. If a compromised account is linked to a corporate mailbox, the attacker can intercept security prompts, manipulate OAuth consent requests and hide new sign-ins from the employee. A trusted profile becomes another route to the VPN.

Session theft raises the stakes further. Stolen cookies can let an attacker reuse an approved login without possessing the second factor, while an OAuth grant can expose mail, files or cloud applications without a password. Browser extensions and information-stealing malware can also capture credentials before multifactor checks occur. Password resets alone may not remove these artefacts, so incident teams must revoke sessions and examine connected applications as well as change credentials.

Help desks are another pressure point. Australian Cyber Security Centre and Australian Signals Directorate advisories have described threat groups associated with Scattered Spider using urgent phone calls, identity details and MFA resets to target organisations. Targets have included telecommunications, finance and critical-infrastructure environments. Remote workers may also use a personal mobile number for account recovery, making that number a security asset rather than a routine administrative detail.

Unpatched appliances create an immediate foothold

Internet-facing appliances have supplied some of the quickest routes into corporate networks. CitrixBleed, tracked as CVE-2023-4966, allowed attackers to steal session tokens and bypass authentication in affected NetScaler gateways. Ivanti Connect Secure then suffered an authentication bypass in CVE-2023-46805 and a file-read weakness in CVE-2024-23897. Fortinet SSL VPN flaws have also been exploited broadly. Patching is essential, but it must be paired with credential rotation, session invalidation and forensic review because attackers may install persistence before an update closes the entry point.

These flaws are attractive because they reduce the work needed to appear legitimate. A successful exploit can produce an authenticated session, privileged configuration access or a web shell without an interactive login. Security teams should compare appliance access with VPN user activity, hunt for newly created administrator accounts and changed interface settings, and inspect the appliance for unexpected files or scripts. US CISA’s Emergency Directive 24-01 set an urgent example for appliance triage, while Australian organisations followed relevant ASD and ACSC alerts.

Once established inside, the attacker usually expands access before announcing it. Valid credentials can be harvested from internal systems, cloud tokens copied from workstations and administrative accounts abused to create persistence. The consequences can outlast the original technical defect. In a separate case, a hacktivist group published stolen police data after a ransomware attempt failed. That incident does not establish a VPN connection, but it demonstrates how a foothold can shift towards theft, publicity and reputational pressure.

Reducing exposure across the Australian workforce

Reducing exposure starts with knowing what exists. Maintain an inventory of internet-facing VPNs, remote administration portals and associated identity providers, including equipment inherited through mergers or maintained by a managed service provider. Remove forgotten accounts, retire unsupported platforms and verify that emergency exceptions have owners and expiry dates. For lean IT teams, this basic inventory often reveals more unmanaged access than a new appliance purchase would.

Architecture matters as well. Management interfaces should not sit directly on the public internet, and ordinary users need no authority to change tunnel routes, authentication policies or certificates. A business can activate a protected workspace as part of separating routine remote work from privileged administration. Strong device posture checks, patched clients and approved access paths make a stolen credential harder to convert into broad internal access.

Australia’s Essential Eight provides a practical baseline: prevent access, detect attacks, respond quickly and recover systems. For remote gateways, that means applying urgent vendor fixes, requiring phishing-resistant MFA and testing whether identities can reach only the applications their roles require. Customs brokerage and freight operations near the ports of Melbourne and Brisbane should include remote administration providers and overseas partners in this review, since shared access can turn one account compromise into a supply-chain problem.

Signals and controls for defenders

Detection depends on joined-up records and clear escalation thresholds. VPN logs alone will not distinguish a travelling employee from an attacker using the same credentials. Compare sign-ins with device certificates, address history, impossible travel, MFA method, application access and changes made immediately after connection. Treat patterns that violate normal behaviour as leads rather than automatic proof, and preserve the relevant records before tokens or sessions expire.

Warning signs worth escalating

• Repeated MFA prompts followed by approval on an unfamiliar device or from an inconsistent location.
• First-time connections through hosting, proxy or anonymisation networks outside approved access patterns.
• New administrators, modified tunnel pools or changed split tunnelling rules.
• Service accounts signing in outside normal hours or reaching management interfaces ordinary users never require.
• Endpoint detections involving credential theft, browser-cookie access or unauthorised OAuth consent grants.
• Unusual east-west traffic, including RDP, SMB and cloud administration from users with limited roles.

The response should cover the identity, the endpoint and the appliance at the same time. Blocking the source address is rarely enough when sessions, tokens or credentials are already in the attacker’s hands. The following controls form an operational baseline that can be adapted to the vendor, business obligations and available staff.

Controls to prioritise across remote access

• Remove public access to management planes and route administration through controlled, monitored bastions.
• Patch exposed gateways on a risk-based schedule and replace end-of-life equipment that no longer receives fixes.
• Require phishing-resistant FIDO2 or passkey authentication, with separate administrator accounts and limited-time elevation.
• Revoke active sessions and rotate credentials after an appliance or identity incident, assuming tokens may remain valid.
• Centralise gateway, identity, endpoint and firewall logs with retention sufficient for a defensible investigation.
• Exercise the full breach path, including supplier notification and guidance from the Australian Signals Directorate.

Legal and reporting duties belong in the playbook rather than at the end of it. If personal information is affected, assess the Australian Privacy Act 1988 and the Notifiable Data Breaches scheme, including whether the incident is likely to cause serious harm. Organisations must notify the Office of the Australian Information Commissioner as soon as reasonably practicable after becoming aware that the reporting threshold has been met. Technical containment, evidence preservation and affected-party decisions should be coordinated with legal, executive and communications teams.

Remote access should be treated as a monitored security boundary, not a trusted extension of the office network. The strongest defence combines a smaller attack surface, resistant authentication, current appliances and fast decisions about unusual sessions. When those controls work together, a stolen password or exposed gateway becomes a contained incident rather than the beginning of a prolonged intrusion.