Ivanti Connect Secure VPN Exploitation: New Observations
Summary: Volexity reported that after proof-of-concept exploit code for Ivanti Connect Secure VPN vulnerabilities CVE-2024-21887 and CVE-2023-46805 became public on January 16, 2024, it observed an increase in attacks from various threat actors, including criminal groups deploying XMRig cryptocurrency miners and a Rust-based payload. A new scan for the GIFTEDVISITOR webshell found an additional 368 compromised appliances, bringing the total to over 2,100, and analysis of a device compromised in December 2023 showed UTA0178 had modified the built-in Integrity Checker Tool so it always reported zero new or mismatched files.
What's compelling: The tool organizations were told to trust for evidence of compromise was altered by UTA0178 to report no findings, so a clean scan on more than 2,100 infected appliances may mean nothing. Volexity also found that importing a backup configuration after applying the mitigation removes it, leaving freshly restored appliances vulnerable again.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2023-46805CVE-2024-21887
- Related