Connect with us

Hi, what are you looking for?



Governments Urge Organizations to Hunt for Ivanti VPN Attacks

Credentials stored on Ivanti VPN appliances impacted by recent vulnerabilities are likely compromised, government agencies say.

Ivanti VPN exploited

Organizations should assume the compromise of Ivanti Connect Secure and Ivanti Policy Secure gateways impacted by recent vulnerabilities and should start hunting for malicious activity, government agencies in Five Eyes countries say.

In a joint advisory, agencies in the US, UK, Canada, Australia, and New Zealand warn of ongoing exploitation of three Ivanti VPN flaws that allow attackers to bypass authentication and execute commands with high privileges.

The bugs, tracked as CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893, were patched on January 31, after Chinese hackers were seen exploiting two of them as zero-days. Two other flaws, CVE-2024-21888 and CVE-2024-22024, were also addressed in the same products.

Along with patches, Ivanti released an Integrity Checker Tool (ICT) to help organizations hunt for signs of compromise. According to CISA, however, the ICT fails and “a cyber threat actor may be able to gain root-level persistence despite issuing factory resets.”

The Five Eyes government agencies encourage organizations to assume that credentials stored on affected appliances have been compromised, to start hunting for malicious activity on their networks, to run the latest version of Ivanti’s ICT, and apply the available patches.

“Based upon the authoring organizations’ observations during incident response activities and available industry reporting, as supplemented by CISA’s research findings, the authoring organizations recommend that the safest course of action for network defenders is to assume a sophisticated threat actor may deploy rootkit level persistence on a device that has been reset and lay dormant for an arbitrary amount of time,” the joint advisory reads.

The Five Eyes agencies also provide a list of indicators of compromise (IoCs) associated with Ivanti VPN exploitation, a set of Yara rules to help detection, and recommendations on incident response and mitigations.

The Five Eyes joint advisory contains information provided by Ivanti and Mandiant. Ivanti explained that the technique CISA used in its lab research has not been observed in attacks, and that applying the same conditions in the wild would break the connection to the appliance, preventing attackers from gaining persistence.

Advertisement. Scroll to continue reading.

“We welcome findings from our security and government partners that enable our customers to protect themselves in the face of this evolving and highly sophisticated threat. To be clear, 29 February advisory does not contain information on a new vulnerability, and Ivanti and our partners are not aware of any instances of successful threat actor persistence following implementation of the security updates and factory resets recommended by Ivanti,” an Ivanti spokesperson said in an emailed comment.

On February 27, Ivanti announced the release of an enhanced ICT that can detect new files or changed files on affected appliances, based on known threat activity. The company also released updated recommendations based on the findings of its investigation into the observed attacks, conducted in collaboration with Mandiant.

The enhanced ICT “provides additional visibility into a customer’s appliance and all files that are present on the system. The enhanced external ICT will no longer require support to decrypt a customer’s snapshots. When new and/or modified files are found, the external ICT will now provide customers with an unencrypted snapshot for their own review,” Ivanti says.

However, the ICT is only meant to complement other tools, Ivanti explains. It cannot identify malicious activity if the appliance has been reset and other tools should be used to monitor changes made between scans and to find malware and other IoCs.

On February 8 and February 14, Ivanti announced new sets of patches for the affected products, which replace the fixes released on January 31. The patches were released for Connect Secure versions 9.1R14.5, 9.1R15.3, 9.1R16.3, 9.1R17.3, 9.1R18.4, 22.1R6.3, 22.2R4.1, 22.3R1, 22.4R1.1, 22.4R2.3, 22.5R1.2, 22.5R2.3 and 22.6R2.2, Policy Secure versions 9.1R16,3, 9.1R17.3, 9.1R18.4, 22.4R1.1, 22.5R1.2 and 22.6R1.1, and ZTA gateways versions 22.5R1.6, 22.6R1.5 and 22.6R1.7.

“Ivanti, Mandiant, CISA and the other JCSA authoring organizations continue to recommend that defenders apply available patching guidance provided by Ivanti if they haven’t done so already, and run Ivanti’s updated Integrity Checker Tool (ICT), released on 27 February, to help detect known attack vectors, alongside continuous monitoring,” the Ivanti spokesperson said.

Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks

Related: Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor

Related: CISA Sets 48-Hour Deadline for Removal of Insecure Ivanti Products

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.


People on the Move

Shay Mowlem has been named CMO of runtime and application security company Contrast Security.

Attack detection firm Vectra AI has appointed Jeff Reed to the newly created role of Chief Product Officer.

Shaun Khalfan has joined payments giant PayPal as SVP, CISO.

More People On The Move

Expert Insights

Related Content


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cloud Security

Cloud security researcher warns that stolen Microsoft signing key was more powerful and not limited to and Exchange Online.

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...


An engineer recruited by intelligence services reportedly used a water pump to deliver Stuxnet, which reportedly cost $1-2 billion to develop.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.