Ivanti Connect Secure Exploited to Install Cryptominers | Grey Noise Blog

Summary: GreyNoise honeypot sensors caught real attackers exploiting a pair of Ivanti Connect Secure vulnerabilities, CVE-2023-46805 and CVE-2024-21887, for which a public exploit exists. The payloads install a persistent cron backdoor and a bitcoin miner, fetch UPX-packed 64-bit and 32-bit Go executables including known malware called watchd0g, and set up an SSH server with a systemd service named .ssh_miner plus a .profile backdoor.
What you should know: A public exploit for these two Ivanti flaws is already being used to plant persistent backdoors and miners, and the article lists specific file paths and IPs to hunt for - the question is whether your Ivanti appliances have been checked against them.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-46805 CVE-2024-21887
Related: Threat Brief: Multiple Ivanti Vulnerabilities (Updated Feb. 29) Cyber Risks ·
What to do with that fancy new internet-connected device you got as a holiday gift Cyber Risks ·
Ivanti Connect Secure VPN Exploitation Goes Global Cyber Risks ·