Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN
Summary: Volexity uncovered in-the-wild exploitation of two chained zero-day vulnerabilities enabling unauthenticated remote code execution on Ivanti Connect Secure VPN appliances, with suspect activity traced back to as early as December 3, 2023. The attacker, tracked as UTA0178 and assessed by Volexity as a Chinese nation-state-level actor, wiped logs, disabled logging, backdoored the compcheckresult.cgi file, and modified lastauthserverused.js to keylog and exfiltrate user credentials.
What you should know: The attacker used stolen VPN credentials to pivot across internal systems and gain unfettered access to the network, and Ivanti's mitigation does not remedy a past or ongoing compromise - so patching alone leaves the breach in place.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026