How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities
Summary: Volexity used memory forensics to confirm in-the-wild exploitation of two chained zero-day vulnerabilities in Ivanti Connect Secure VPN, decoding base64 POST payloads found in the heap of the uwsgi web server process (PID 2952) to recover the exploit path POST /api/v1/totp/user-backup-code/../../system/maintenance/archiving/cloud-server-test-connection. Analysis also tied requests to remote IPs 98.160.48.170 and 173.220.106.166, attributed to compromised Cyberoam devices, and found a second uwsgi process (PID 31694) running as root initiating SSH connections back to the attacker.
Key Takeaway: The vital POST payload existed only in memory, and the attacker modified the built-in Integrity Checking Tool to evade detection, so a disk image or the device's own checker could have shown nothing while the appliance was fully owned at root.
Read the original at Volexity Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026