Ivanti Connect Secure VPN Exploitation Goes Global
Summary: Volexity reported that attackers tracked as UTA0178 exploited two zero-day vulnerabilities, CVE-2024-21887 and CVE-2023-46805, in Ivanti Connect Secure VPN appliances, with widespread exploitation beginning January 11, 2024. Scanning roughly 30,000 ICS IP addresses, Volexity identified over 1,700 appliances compromised with the GIFTEDVISITOR webshell, and it assesses with medium confidence that UTA0178 carried out the campaign.
Why it matters: Volexity says its scan method would not have worked against organizations that had already applied the Ivanti mitigation or taken systems offline, so the true count of compromised organizations is likely higher than the 1,700 it found - and it notes additional attackers beyond UTA0178 appear to have access to the exploit.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Mentions
- CVE-2023-46805CVE-2024-21887
- Related