Threat reportThreat IntelligenceTL-2026-1774
Sen. Wyden Urges Binding Federal Mandate to Purge Internet-Facing Legacy VPNs for Zero-Trust Remote Access
Sen. Wyden Urges Binding Federal Mandate to Purge (TL-2026-1774), also tracked as Federal Legacy VPN Purge Mandate, is a medium-severity tracked intrusion set, first published 2026-07-27. It is attributed to Russian state-sponsored APT clusters (China, Russia, Iran) with high confidence, affects Ivanti (formerly Pulse Secure) Connect Secure / Policy Secure, references 21 CVEs (CVE-2019-11510, CVE-2019-11539, CVE-2019-19781), maps to 32 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 21Referenced vulnerabilities
- Techniques
- 32MITRE ATT&CK
- Actors
- 1Russian state-sponsored APT clusters
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1774
- Threat ID
- TL-2026-1774
- Also known as
- Federal Legacy VPN Purge Mandate, Wyden Zero-Trust VPN Directive Proposal
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Russian state-sponsored APT clusters
- Attribution confidence
- HIGH
- Nation-state nexus
- China, Russia, Iran
- Motivation
- ESPIONAGE
- Target sectors
- government administration, federal civilian agencies, defense industrial base, critical infrastructure, legal services, technology, telecoms, managed service providers
- Target regions
- North America, united states of america
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Sen. Wyden Urges Binding Federal Mandate to Purge
Malware and tooling: BRICKSTEAL, BRICKSTORM - S9015, DRYHOOK - S9013, PHASEJAM - S9014, SPAWN, SPAWNMOLE, SPAWNSLOTH, SPAWNSNAIL, Garble, Line Dancer, Line Runner
How Sen. Wyden Urges Binding Federal Mandate to Purge works
On 2026-07-27, Sen. Ron Wyden sent a letter (with accompanying CRS memo) to OMB, CISA, and NIST calling for a binding operational directive requiring federal civilian agencies to eliminate internet-facing legacy VPN appliances within two years and migrate to zero-trust network access (ZTNA), citing a multi-year pattern of Chinese and Russian state-sponsored actors repeatedly compromising Pulse Secure, Ivanti, VMware, F5, Cisco, Fortinet, and Check Point remote-access products. The letter also proposes FAR/DFARS procurement rules barring purchase of non-NIST-zero-trust-certified remote-access products.
Senator Ron Wyden (D-OR) sent a letter dated 2026-07-27 to OMB Federal CISO Gregory Barbaccia, CISA, and NIST, accompanied by a Congressional Research Service (CRS) memo, arguing that the federal government's reliance on internet-facing legacy VPN appliances constitutes an unfixable architectural weakness rather than a series of isolated patching failures. The letter documents that Chinese and Russian state-sponsored hacking groups have repeatedly exploited internet-facing VPN and network-edge products from Pulse Secure, VMware, Ivanti, F5, and Cisco (reporting from CyberScoop and CyberInsider additionally names Fortinet and Check Point) against federal agencies and government contractors, prompting numerous CISA emergency directives over the past several years (ED 21-03 for Pulse Connect Secure in 2021, ED 24-01 for Ivanti Connect Secure/Policy Secure in 2024, and ED 26-01 for F5 BIG-IP in 2025).
This pattern is independently corroborated by the historical exploitation record: CVE-2019-11510 (Pulse Secure pre-auth arbitrary file read) was exploited by Iranian actors (OilRig, Chafer, Shamoon) and later cited in a 2020 DOJ indictment of Chinese APT41 members for supply-chain intrusions; CVE-2023-46805/CVE-2024-21887 (Ivanti Connect Secure) triggered CISA ED 24-01 after suspected China-nexus exploitation; CVE-2025-0282 (Ivanti) was zero-day exploited from mid-December 2024 by UNC5337 (part of the broader UNC5221 cluster) deploying the SPAWN malware family; Cisco ASA/FTD firewalls were targeted since mid-2023 by the state-sponsored ArcaneDoor campaign (Cisco Talos: UAT4356; Microsoft: STORM-1849) using the custom Line Dancer and Line Runner implants; VMware Tools/vCenter/ESXi flaws (CVE-2025-41244, CVE-2024-37079, CVE-2025-22224/22225/22226) were exploited by China-nexus UNC5174; and in October 2025 F5 disclosed that a nation-state actor (linked to China-nexus UNC5221 and the BRICKSTORM backdoor) had persistent, undetected access to its BIG-IP product-development and engineering-knowledge environments for roughly 12 months, exfiltrating source code and undisclosed-vulnerability data, prompting CISA ED 26-01.
The CRS memo explains that zero-trust architectures replace these inbound-listening, internet-exposed appliances with outbound-only connections that continuously verify user/device identity and restrict access to specific applications rather than the whole network, eliminating the scannable, always-open attack surface that adversaries have exploited for over half a decade. Wyden's specific asks: (1) CISA issue a Binding Operational Directive requiring FCEB civilian agencies to eliminate legacy public-facing VPNs within two years; (2) NSA impose an equivalent deadline on military/intelligence-community networks; (3) NIST publish implementation standards mandating outbound-only zero-trust architectures, memory-safe programming languages, agency-controlled encryption keys, and alignment with post-quantum cryptography; (4) OMB draft a memo directing agency investment in zero-trust infrastructure; and (5) FAR/DFARS be updated to bar agencies and defense contractors from purchasing VPN/remote-access products unless the vendor formally attests NIST zero-trust compliance. The letter cites a Travelers Q4 2025 Cyber Threat Report finding that 85% of ransomware-related cyber-insurance claims stemmed from exploited VPNs, underscoring that the exposure is not limited to nation-state espionage but also enables ransomware access-brokering.
MITRE ATT&CK techniques used in TL-2026-1774
Credential Access
T1003 OS Credential Dumping; T1110 Brute Force; T1552 Unsecured Credentials
Discovery
T1018 Remote System Discovery; T1082 System Information Discovery
Lateral Movement
T1021 Remote Services; T1210 Exploitation of Remote Services
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1132 Data Encoding; T1568 Dynamic Resolution; T1572 Protocol Tunneling
Collection
T1074 Data Staged; T1560 Archive Collected Data
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
T1136 Create Account; T1505 Server Software Component; T1543 Create or Modify System Process
Impact
T1486 Data Encrypted for Impact
defense-impairment
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Sen. Wyden Urges Binding Federal Mandate to Purge
- Ivanti (formerly Pulse Secure) — Connect Secure / Policy Secure
Vulnerable versions: 9.x; 22.x pre-patch
Fixed in: patched builds per CISA ED 24-01 and Jan 2025 advisory - Pulse Secure — Pulse Connect Secure (PCS)
Vulnerable versions: 8.2 before 8.2R12.1; 8.3 before 8.3R7
Fixed in: 8.2R12.1+; 8.3R7+ - VMware (Broadcom) — VMware Tools / vCenter Server / ESXi
Vulnerable versions: versions affected by CVE-2025-41244, CVE-2024-37079, CVE-2025-22224/22225/22226
Fixed in: vendor patches released 2025 - F5 — BIG-IP
Vulnerable versions: versions in scope of Oct 2025 nation-state breach disclosure
Fixed in: updates released by 2025-10-22 per CISA ED 26-01 - Cisco — ASA / Firepower Threat Defense (FTD)
Vulnerable versions: versions affected by CVE-2024-20353, CVE-2024-20358, CVE-2024-20359
Fixed in: patched releases per Cisco April 2024 advisory - Fortinet — FortiOS / FortiProxy SSL-VPN
Vulnerable versions: versions affected by CVE-2023-27997
Fixed in: patched per June 2023 advisory - Check Point — Security Gateway (CloudGuard Network, Quantum Maestro/Scalable Chassis/Security Gateways/Spark)
Vulnerable versions: versions affected by CVE-2024-24919
Fixed in: patched per May 2024 advisory
Remediation for Sen. Wyden Urges Binding Federal Mandate to Purge
Patches
- Ivanti Connect Secure/Policy Secure patches for CVE-2023-46805, CVE-2024-21887, CVE-2025-0282
- Cisco ASA/FTD patches for CVE-2024-20353, CVE-2024-20358, CVE-2024-20359 (ArcaneDoor)
- Fortinet FortiOS/FortiProxy patch for CVE-2023-27997
- Check Point Security Gateway patch for CVE-2024-24919
- VMware Tools/vCenter/ESXi patches for CVE-2025-41244, CVE-2024-37079, CVE-2025-22224, CVE-2025-22225, CVE-2025-22226
- F5 BIG-IP updates released in the October 2025 nation-state-breach disclosure (per CISA ED 26-01)
Immediate actions
- Inventory all internet-facing VPN/remote-access appliances (Pulse Secure, Ivanti, VMware, F5, Cisco, Fortinet, Check Point) and confirm no management interfaces are exposed to the public internet
- Apply all outstanding vendor patches for known-exploited VPN/edge-device CVEs and check against the CISA KEV catalog
- Hunt for indicators of the documented campaigns (BRICKSTORM, SPAWN family, Line Dancer/Line Runner) on any appliance that has ever been internet-facing
Workarounds
- Restrict VPN/remote-access management interfaces to trusted internal networks or a bastion/jump host, not the open internet
- Enforce MFA on all remote-access accounts to blunt password-hash-harvesting flaws like CVE-2024-24919
Longer-term hardening
- Migrate remote access to zero-trust network access (ZTNA) with outbound-only connections per NIST SP 800-207
- Adopt memory-safe programming languages for network-edge product development where feasible
- Move to agency-controlled encryption keys for remote-access products to reduce vendor supply-chain risk
- Align remote-access cryptography with post-quantum migration timelines
CVEs associated with Sen. Wyden Urges Binding Federal Mandate to Purge
Weaknesses (CWE) in Sen. Wyden Urges Binding Federal Mandate to Purge
CWE-287, CWE-78, CWE-22, CWE-121, CWE-190, CWE-200, CWE-863, CWE-306
Timeline of Sen. Wyden Urges Binding Federal Mandate to Purge
- Pulse Secure discloses CVE-2019-11510, a pre-authentication arbitrary file read in Pulse Connect Secure, later exploited by Iranian actors (OilRig, Chafer, Shamoon) and cited in a 2020 DOJ indictment of Chinese APT41 members.
- CISA issues Emergency Directive 21-03 requiring federal civilian agencies to run the Pulse Connect Secure Integrity Tool after Mandiant/FireEye attributes exploitation of CVE-2021-22893 to state-backed clusters UNC2630 and UNC2717.
- Fortinet discloses CVE-2023-27997 (XORtigate), a heap-based buffer overflow in FortiOS/FortiProxy SSL-VPN, later confirmed exploited in the wild and added to the CISA KEV catalog; tied to the FortiBleed credential-exposure campaign.
- Evidence later reviewed by Cisco Talos indicates the state-sponsored ArcaneDoor campaign against Cisco ASA/FTD firewalls began around this time, roughly nine months before discovery.
- Ivanti discloses CVE-2023-46805 and CVE-2024-21887 (Connect Secure/Policy Secure auth-bypass and command injection), already under active zero-day exploitation.
- CISA issues Emergency Directive 24-01 ordering FCEB agencies to mitigate and disconnect vulnerable Ivanti Connect Secure/Policy Secure appliances.
- Cisco Talos publicly discloses the ArcaneDoor espionage campaign (tracked as UAT4356 / Microsoft STORM-1849) and ships patches for CVE-2024-20353 and CVE-2024-20359, exploited via the custom Line Dancer and Line Runner implants.
- Check Point discloses CVE-2024-24919, an information-disclosure zero-day in Security Gateway VPN products already under active exploitation since early April 2024.
- China-nexus actor UNC5174 begins exploiting a VMware Tools local-privilege-escalation flaw (later CVE-2025-41244), continuing undetected for roughly a year.
- Ivanti discloses CVE-2025-0282, a stack-based buffer overflow in Connect Secure/Policy Secure/Neurons for ZTA already exploited as a zero-day since mid-December 2024 by China-nexus UNC5337 (part of the broader UNC5221 cluster), deploying the SPAWN malware family (SPAWNANT, SPAWNMOLE, SPAWNSNAIL, SPAWNSLOTH) plus PHASEJAM and DRYHOOK.
- Broadcom discloses three VMware ESXi zero-days (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226) exploited to escape virtual machines and gain hypervisor control, in one case pivoting from a compromised SonicWall VPN appliance.
- F5 discovers that a nation-state threat actor has had long-term persistent access to its BIG-IP product-development and engineering-knowledge-management environments.
- F5 publicly discloses the nation-state breach (BIG-IP source code and undisclosed-vulnerability data exfiltrated over roughly 12 months, linked to China-nexus UNC5221 and the BRICKSTORM backdoor); CISA issues Emergency Directive 26-01 requiring FCEB agencies to inventory and patch BIG-IP by 2025-10-22.
- CISA, NSA, and the Canadian Centre for Cyber Security jointly publish a Malware Analysis Report (MAR-2512217/AR25-338A) on the BRICKSTORM backdoor used by China-nexus UNC5221 against U.S. legal, SaaS, technology, and public-sector targets since at least April 2024.
- Sen. Ron Wyden sends a letter with an accompanying CRS memo to OMB, CISA, and NIST calling for a binding operational directive to purge internet-facing legacy VPNs from federal networks within two years and mandate zero-trust remote access and vendor certification.
Sources cited for Sen. Wyden Urges Binding Federal Mandate to Purge
- Letter to OMB, CISA, and NIST on legacy VPN replacement (Sen. Ron Wyden, with CRS memo)
- Sen. Wyden urges feds to discard older, insecure, public-facing VPNs
- Outdated VPNs should be purged from federal agencies, senator says
- Wyden calls for federal ban on legacy VPNs over security concerns
- Wyden urges federal agencies to replace legacy VPNs with zero-trust architectures to counter nation-state cyber threats
- Wyden Demands Two-Year Federal VPN Purge: Zero-Trust Procurement Rule Would Reshape Vendor Market
- ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities
- ED 21-03: Mitigate Pulse Connect Secure Product Vulnerabilities (Closed)
- Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)
- ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices
- CISA issues emergency directive after F5 discloses nation-state breach
- F5 Breach Exposes BIG-IP Source Code — Nation-State Hackers Behind Massive Intrusion
- PRC State-Sponsored Actors Use BRICKSTORM Malware Across Public Sector and Information Technology Systems
- PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
- CVE-2025-0282: Ivanti Connect Secure Zero-Day Vulnerability Exploited In The Wild
Detection coverage for TL-2026-1774
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1774 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.