NYDFS Alerts Regulated Entities to N-central Vulnerability Exploited by Threat Actors

The New York State Department of Financial Services ("NYDFS") alerted regulated entities to an active cybersecurity campaign exploiting a vulnerability in a remote monitoring system used by managed service providers ("MSPs").

In the alert, NYDFS stated that threat actors are targeting a known vulnerability in N-central, a remote monitoring and management system developed by N-able. Once inside an MSP environment, threat actors may create or register for new services, allowing continued access even after compromised N-central credentials are revoked. NYDFS said attackers are using compromised MSP environments to move laterally into customer networks and information systems with administrator network privileges.

NYDFS said regulated entities should promptly determine whether N-central is used within their environment or by any MSP or other third-party service provider that supports their information systems. Where the system is in use, the Department said entities should work with their service providers to review activity logs for unauthorized access, verify that security patches have been applied, and evaluate whether systems or credentials were affected.

While the vulnerability primarily affects MSPs, NYDFS reminded senior governing bodies and officers that they must actively oversee third-party service providers as part of their cybersecurity risk management.

The Department also said entities should continue to report all cybersecurity incidents to NYDFS, including those originating at third-party service providers, as required by Section 500.17 of 23 NYCRR Part 500 ("Cybersecurity Requirements for Financial Services Companies"). The alert did not set a compliance deadline but stated that entities should act promptly to assess and mitigate potential exposure.