TechHub

OTX BotMalware Identified in Attacks Exploiting Ivanti Connect Secure VulnerabilitiesThe article details malware and tactics used in attacks targeting Ivanti Connect Secure vulnerabilities from December 2024 to July 2025. It describes MDifyLoader, a loader based on libPeConv, which deploys Cobalt Strike Beacon through DLL side-loading. The attackers also utilized vshell, a multi-platform RAT, and Fscan, a network scanning tool. After gaining initial access, the threat actors performed lateral movement using brute-force attacks, exploited vulnerabilities, and used stolen credentials. They established persistence by creating domain accounts and registering malware as services or scheduled tasks. The attackers employed various evasion techniques, including the use of legitimate files and ETW bypasses.Pulse ID: 6879f8b560d48aaf15291507 Pulse Link: <a href="https://otx.alienvault.com/pulse/6879f8b560d48aaf15291507" rel="nofollow noopener" translate="no" target="_blank">https://otx.alienvault.com/pulse/6879f8b560d48aaf15291507</a> Pulse Author: AlienVault Created: 2025-07-18 07:33:09Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/CobaltStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CobaltStrike</a> <a href="https://social.raytec.co/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/ICS" class="mention hashtag" rel="nofollow noopener" target="_blank">#ICS</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/RAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#RAT</a> <a href="https://social.raytec.co/tags/RCE" class="mention hashtag" rel="nofollow noopener" target="_blank">#RCE</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#AlienVault</a>

Cedric🚨 April 2025 Vulnerability Report is out! 🚨👉 <a href="https://www.vulnerability-lookup.org/2025/05/01/vulnerability-report-april-2025/" rel="nofollow noopener" translate="no" target="_blank">https://www.vulnerability-lookup.org/2025/05/01/vulnerability-report-april-2025/</a>The most prominent vulnerabilities affect the following products:- <a href="https://social.circl.lu/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> / <a href="https://social.circl.lu/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> - <a href="https://social.circl.lu/tags/Erlang" class="mention hashtag" rel="nofollow noopener" target="_blank">#Erlang</a> / OTP - <a href="https://social.circl.lu/tags/SAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#SAP</a> / SAP NetWeaverThe Continuous Exploitation section highlights several resurgent vulnerabilities (recently exploited at a high rate).💻 NISDUC Conference<a href="https://social.circl.lu/tags/VulnerabilityLookup" class="mention hashtag" rel="nofollow noopener" target="_blank">#VulnerabilityLookup</a> will be presented during the fourth <a href="https://social.circl.lu/tags/NISDUC" class="mention hashtag" rel="nofollow noopener" target="_blank">#NISDUC</a> conference.👉 <a href="https://www.nisduc.eu" rel="nofollow noopener" translate="no" target="_blank">https://www.nisduc.eu</a><a href="https://social.circl.lu/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://social.circl.lu/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://social.circl.lu/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a>

Pyrzout :vm:ConnectSecure empowers MSPs to mitigate risks within their clients’ Google Workspace environments <a href="https://www.helpnetsecurity.com/2025/04/15/connectsecure-google-workspace-assessments/" rel="nofollow noopener" translate="no" target="_blank">https://www.helpnetsecurity.com/2025/04/15/connectsecure-google-workspace-assessments/</a> <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/Industrynews" class="mention hashtag" rel="nofollow noopener" target="_blank">#Industrynews</a>

Pyrzout :vm:Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle – Source: www.securityweek.com <a href="https://ciso2ciso.com/rapid7-reveals-rce-path-in-ivanti-vpn-appliance-after-silent-patch-debacle-source-www-securityweek-com/" rel="nofollow noopener" translate="no" target="_blank">https://ciso2ciso.com/rapid7-reveals-rce-path-in-ivanti-vpn-appliance-after-silent-patch-debacle-source-www-securityweek-com/</a> <a href="https://social.skynetcloud.site/tags/rssfeedpostgeneratorecho" class="mention hashtag" rel="nofollow noopener" target="_blank">#rssfeedpostgeneratorecho</a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurityNews</a> <a href="https://social.skynetcloud.site/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#IncidentResponse</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a>&Threats <a href="https://social.skynetcloud.site/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerabilities</a> <a href="https://social.skynetcloud.site/tags/securityweekcom" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityweekcom</a> <a href="https://social.skynetcloud.site/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE</a>-2025-22457 <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/securityweek" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityweek</a> <a href="https://social.skynetcloud.site/tags/Mandiant" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mandiant</a> <a href="https://social.skynetcloud.site/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://social.skynetcloud.site/tags/Rapid7" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rapid7</a> <a href="https://social.skynetcloud.site/tags/VPN" class="mention hashtag" rel="nofollow noopener" target="_blank">#VPN</a>

Pyrzout :vm:Rapid7 Reveals RCE Path in Ivanti VPN Appliance After Silent Patch Debacle <a href="https://www.securityweek.com/rapid7-reveals-rce-path-in-ivanti-vpn-appliance-after-silent-patch-debacle/" rel="nofollow noopener" translate="no" target="_blank">https://www.securityweek.com/rapid7-reveals-rce-path-in-ivanti-vpn-appliance-after-silent-patch-debacle/</a> <a href="https://social.skynetcloud.site/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener" target="_blank">#IncidentResponse</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a>&Threats <a href="https://social.skynetcloud.site/tags/Vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerabilities</a> <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/CVE202522457" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE202522457</a> <a href="https://social.skynetcloud.site/tags/Mandiant" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mandiant</a> <a href="https://social.skynetcloud.site/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://social.skynetcloud.site/tags/Rapid7" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rapid7</a> <a href="https://social.skynetcloud.site/tags/VPN" class="mention hashtag" rel="nofollow noopener" target="_blank">#VPN</a>

Pyrzout :vm:Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances  – Source: www.securityweek.com <a href="https://ciso2ciso.com/chinese-apt-pounces-on-misdiagnosed-rce-in-ivanti-vpn-appliances-source-www-securityweek-com/" rel="nofollow noopener" translate="no" target="_blank">https://ciso2ciso.com/chinese-apt-pounces-on-misdiagnosed-rce-in-ivanti-vpn-appliances-source-www-securityweek-com/</a> <a href="https://social.skynetcloud.site/tags/rssfeedpostgeneratorecho" class="mention hashtag" rel="nofollow noopener" target="_blank">#rssfeedpostgeneratorecho</a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurityNews</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a>&Threats <a href="https://social.skynetcloud.site/tags/NetworkSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#NetworkSecurity</a> <a href="https://social.skynetcloud.site/tags/securityweekcom" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityweekcom</a> <a href="https://social.skynetcloud.site/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE</a>-2025-22457 <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/PulseConnect" class="mention hashtag" rel="nofollow noopener" target="_blank">#PulseConnect</a> <a href="https://social.skynetcloud.site/tags/securityweek" class="mention hashtag" rel="nofollow noopener" target="_blank">#securityweek</a> <a href="https://social.skynetcloud.site/tags/Mandiant" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mandiant</a> <a href="https://social.skynetcloud.site/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://social.skynetcloud.site/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a>

Pyrzout :vm:Chinese APT Pounces on Misdiagnosed RCE in Ivanti VPN Appliances <a href="https://www.securityweek.com/chinese-apt-pounces-on-misdiagnosed-rce-in-ivanti-vpn-appliances/" rel="nofollow noopener" translate="no" target="_blank">https://www.securityweek.com/chinese-apt-pounces-on-misdiagnosed-rce-in-ivanti-vpn-appliances/</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a>&Threats <a href="https://social.skynetcloud.site/tags/NetworkSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#NetworkSecurity</a> <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/CVE202522457" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE202522457</a> <a href="https://social.skynetcloud.site/tags/PulseConnect" class="mention hashtag" rel="nofollow noopener" target="_blank">#PulseConnect</a> <a href="https://social.skynetcloud.site/tags/Mandiant" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mandiant</a> <a href="https://social.skynetcloud.site/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://social.skynetcloud.site/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a>

Rene RobichaudPoC Exploit Released for Ivanti Connect Secure RCE Vulnerability <a href="https://gbhackers.com/poc-ivanti-connect-secure-rce-vulnerability/" rel="nofollow noopener" translate="no" target="_blank">https://gbhackers.com/poc-ivanti-connect-secure-rce-vulnerability/</a><a href="https://mastodon.social/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infosec</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://mastodon.social/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://mastodon.social/tags/CeptBiro" class="mention hashtag" rel="nofollow noopener" target="_blank">#CeptBiro</a> <a href="https://mastodon.social/tags/PoCExploit" class="mention hashtag" rel="nofollow noopener" target="_blank">#PoCExploit</a> <a href="https://mastodon.social/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://mastodon.social/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://mastodon.social/tags/RCE" class="mention hashtag" rel="nofollow noopener" target="_blank">#RCE</a> <a href="https://mastodon.social/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a>

Pyrzout :vm:Ivanti Urges Patch for Flaws in Connect Secure, Policy Secure and ZTA Gateways – Source:hackread.com <a href="https://ciso2ciso.com/ivanti-urges-patch-for-flaws-in-connect-secure-policy-secure-and-zta-gateways-sourcehackread-com/" rel="nofollow noopener" translate="no" target="_blank">https://ciso2ciso.com/ivanti-urges-patch-for-flaws-in-connect-secure-policy-secure-and-zta-gateways-sourcehackread-com/</a> <a href="https://social.skynetcloud.site/tags/1CyberSecurityNewsPost" class="mention hashtag" rel="nofollow noopener" target="_blank">#1CyberSecurityNewsPost</a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurityNews</a> <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://social.skynetcloud.site/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://social.skynetcloud.site/tags/PolicySecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#PolicySecure</a> <a href="https://social.skynetcloud.site/tags/ZTAGateways" class="mention hashtag" rel="nofollow noopener" target="_blank">#ZTAGateways</a> <a href="https://social.skynetcloud.site/tags/Hackread" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hackread</a> <a href="https://social.skynetcloud.site/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://social.skynetcloud.site/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a>

Pyrzout :vm:Ivanti Urges Patch for Flaws in Connect Secure, Policy Secure and ZTA Gateways <a href="https://hackread.com/ivanti-patch-flaws-connect-secure-policy-secure-zta-gateways/" rel="nofollow noopener" translate="no" target="_blank">https://hackread.com/ivanti-patch-flaws-connect-secure-policy-secure-zta-gateways/</a> <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://social.skynetcloud.site/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://social.skynetcloud.site/tags/PolicySecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#PolicySecure</a> <a href="https://social.skynetcloud.site/tags/ZTAGateways" class="mention hashtag" rel="nofollow noopener" target="_blank">#ZTAGateways</a> <a href="https://social.skynetcloud.site/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://social.skynetcloud.site/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a>

Pyrzout :vm:Ivanti Warns of New Zero-Day Attacks Hitting Connect Secure Product <a href="https://www.securityweek.com/ivanti-warns-of-new-zero-day-attacks-hitting-connect-secure-product/" rel="nofollow noopener" translate="no" target="_blank">https://www.securityweek.com/ivanti-warns-of-new-zero-day-attacks-hitting-connect-secure-product/</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a>&Threats <a href="https://social.skynetcloud.site/tags/NetworkSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#NetworkSecurity</a> <a href="https://social.skynetcloud.site/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerabilities</a> <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/CVE20250282" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE20250282</a> <a href="https://social.skynetcloud.site/tags/CVE20250283" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE20250283</a> <a href="https://social.skynetcloud.site/tags/Featured" class="mention hashtag" rel="nofollow noopener" target="_blank">#Featured</a> <a href="https://social.skynetcloud.site/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a>

Pyrzout :vm:ConnectSecure unveils M365 Assessment Module to help MSPs identify security weaknesses <a href="https://www.helpnetsecurity.com/2024/10/01/connectsecure-m365-assessment-module/" rel="nofollow noopener" translate="no" target="_blank">https://www.helpnetsecurity.com/2024/10/01/connectsecure-m365-assessment-module/</a> <a href="https://social.skynetcloud.site/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.skynetcloud.site/tags/Industrynews" class="mention hashtag" rel="nofollow noopener" target="_blank">#Industrynews</a>

Not SimonMITRE disclosed that one of their research and development networks was compromised by a foreign nation-state threat actor in January 2024 using Ivanti Connect Secure zero-days CVE-2023-46805 and CVE-2024-21887. Networked Experimentation, Research, and Virtualization Environment (NERVE) is a collaborative network used for research, development, and prototyping. MITRE included a timeline, observed TTP methods (mapped out to MITRE ATT&CK techniques cc: <a href="https://infosec.exchange/@howelloneill" class="u-url mention" rel="nofollow noopener" target="_blank">@howelloneill</a>) and their incident response actions. No IOC provided. 🔗 <a href="https://www.mitre.org/news-insights/news-release/mitre-response-cyber-attack-one-its-rd-networks" rel="nofollow noopener" translate="no" target="_blank">https://www.mitre.org/news-insights/news-release/mitre-response-cyber-attack-one-its-rd-networks</a> and <a href="https://medium.com/mitre-engenuity/advanced-cyber-threats-impact-even-the-most-prepared-56444e980dc8" rel="nofollow noopener" translate="no" target="_blank">https://medium.com/mitre-engenuity/advanced-cyber-threats-impact-even-the-most-prepared-56444e980dc8</a> h/t <a href="https://infosec.exchange/@reverseics" class="u-url mention" rel="nofollow noopener" target="_blank">@reverseics</a> cc: <a href="https://mastodon.social/@campuscodi" class="u-url mention" rel="nofollow noopener" target="_blank">@campuscodi</a> <a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener" target="_blank">@briankrebs</a> <a href="https://infosec.exchange/tags/MITRE" class="mention hashtag" rel="nofollow noopener" target="_blank">#MITRE</a> <a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/CVE_2023_46805" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2023_46805</a> <a href="https://infosec.exchange/tags/CVE_2024_21887" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21887</a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#threatintel</a> <a href="https://infosec.exchange/tags/cyberespionage" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberespionage</a>

Not SimonI buried the lede in not mentioning that UNC5291 is assessed with medium confidence to be associated with Volt Typhoon, a Chinese state-sponsored Advanced Persistent Threat (APT).  See related The Record reporting: <a href="https://therecord.media/volt-typhoon-china-targeting-energy-defense-ivanti-bugs" rel="nofollow noopener" target="_blank">Volt Typhoon and 4 other groups targeting US energy and defense sectors through Ivanti bugs</a><a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/cyberespionage" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberespionage</a> <a href="https://infosec.exchange/tags/China" class="mention hashtag" rel="nofollow noopener" target="_blank">#China</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> <a href="https://infosec.exchange/tags/CVE_2023_46805" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2023_46805</a> <a href="https://infosec.exchange/tags/CVE_2024_21887" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21887</a> <a href="https://infosec.exchange/tags/CVE_2024_21893" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21893</a> <a href="https://infosec.exchange/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://infosec.exchange/tags/UNC5266" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5266</a> <a href="https://infosec.exchange/tags/UNC5330" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5330</a> <a href="https://infosec.exchange/tags/UNC5337" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5337</a> <a href="https://infosec.exchange/tags/UNC5291" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5291</a>

Not SimonMandiant releases part 4 of the Ivanti Connect Secure incident response investigation. They detail different types of post-exploitation activity across their IR engagements. Chinese threat actors have a growing knowledge of Ivanti Connect Secure in abusing appliance-specific functionality to perform actions on objective. They highlight FIVE Chinese threat actors: UNC5221, UNC5266, UNC5330, UNC5337, and UNC5291 abusing a mix of CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893. New TTPs, new malware families and new IOC: 🔗 <a href="https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement" rel="nofollow noopener" translate="no" target="_blank">https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement</a>EDIT: For your situational awareness, it's my understanding that future Mandiant articles will be located at <a href="https://cloud.google.com/blog/topics/threat-intelligence/" rel="nofollow noopener" translate="no" target="_blank">https://cloud.google.com/blog/topics/threat-intelligence/</a><a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/cyberespionage" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberespionage</a> <a href="https://infosec.exchange/tags/China" class="mention hashtag" rel="nofollow noopener" target="_blank">#China</a> <a href="https://infosec.exchange/tags/activeexploitation" class="mention hashtag" rel="nofollow noopener" target="_blank">#activeexploitation</a> <a href="https://infosec.exchange/tags/eitw" class="mention hashtag" rel="nofollow noopener" target="_blank">#eitw</a> <a href="https://infosec.exchange/tags/zeroday" class="mention hashtag" rel="nofollow noopener" target="_blank">#zeroday</a> <a href="https://infosec.exchange/tags/KEV" class="mention hashtag" rel="nofollow noopener" target="_blank">#KEV</a> <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> <a href="https://infosec.exchange/tags/CVE_2023_46805" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2023_46805</a> <a href="https://infosec.exchange/tags/CVE_2024_21887" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21887</a> <a href="https://infosec.exchange/tags/CVE_2024_21893" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21893</a> <a href="https://infosec.exchange/tags/UNC5221" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5221</a> <a href="https://infosec.exchange/tags/UNC5266" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5266</a> <a href="https://infosec.exchange/tags/UNC5330" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5330</a> <a href="https://infosec.exchange/tags/UNC5337" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5337</a> <a href="https://infosec.exchange/tags/UNC5291" class="mention hashtag" rel="nofollow noopener" target="_blank">#UNC5291</a>

Not SimonI want to get off Mr. Ivanti's wild ride: security advisory for Ivanti Connect Secure and Ivanti Policy Secure: 🔗 <a href="https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways" rel="nofollow noopener" translate="no" target="_blank">https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways</a> and blog post: <a href="https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-policy-secure" rel="nofollow noopener" translate="no" target="_blank">https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-policy-secure</a><ul><li>CVE-2024-21894 (8.2 high) heap overflow leads to Denial of Service (DoS), and sometimes arbitrary code execution</li><li>CVE-2024-22052 (7.5 high) null pointer dereference causes DoS</li><li>CVE-2024-22053 (8.2 high) heap overflow leads to DoS or information disclosure</li><li>CVE-2024-22023 (5.3 medium) XML entity expansion (XEE) causes a limited-time DoS</li></ul><blockquote>We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. </blockquote><a href="https://infosec.exchange/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://infosec.exchange/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://infosec.exchange/tags/PolicySecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#PolicySecure</a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#vulnerability</a> <a href="https://infosec.exchange/tags/CVE_2024_21894" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_21894</a> <a href="https://infosec.exchange/tags/CVE_2024_22052" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_22052</a> <a href="https://infosec.exchange/tags/CVE_2024_22053" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_22053</a> <a href="https://infosec.exchange/tags/CVE_2024_22023" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE_2024_22023</a>

OTX BotThreat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure GatewaysCyber threat actors are actively exploiting multiple vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways that can be chained to bypass authentication, craft malicious requests, and execute arbitrary commands. This enables threat actors to implant web shells for persistence and harvest credentials stored on compromised devices.Pulse ID: 65e1a5b18d307f0d4139697b Pulse Link: <a href="https://otx.alienvault.com/pulse/65e1a5b18d307f0d4139697b" rel="nofollow noopener" translate="no" target="_blank">https://otx.alienvault.com/pulse/65e1a5b18d307f0d4139697b</a> Pulse Author: AlienVault Created: 2024-03-01 09:53:53Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/Ivanti" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ivanti</a> <a href="https://social.raytec.co/tags/ConnectSecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectSecure</a> <a href="https://social.raytec.co/tags/PolicySecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#PolicySecure</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#AlienVault</a>

Recent searches

Search options

Administered by:

Server stats:

#connectsecure