Organizations should assume the compromise of Ivanti Connect Secure and Ivanti Policy Secure gateways impacted by recent vulnerabilities and should start hunting for malicious activity, government agencies in Five Eyes countries say.
In a joint advisory, agencies in the US, UK, Canada, Australia, and New Zealand warn of ongoing exploitation of three Ivanti VPN flaws that allow attackers to bypass authentication and execute commands with high privileges.
The bugs, tracked as CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893, were patched on January 31, after Chinese hackers were seen exploiting two of them as zero-days. Two other flaws, CVE-2024-21888 and CVE-2024-22024, were also addressed in the same products.
Along with patches, Ivanti released an Integrity Checker Tool (ICT) to help organizations hunt for signs of compromise. According to CISA, however, the ICT fails and “a cyber threat actor may be able to gain root-level persistence despite issuing factory resets.”
The Five Eyes government agencies encourage organizations to assume that credentials stored on affected appliances have been compromised, to start hunting for malicious activity on their networks, to run the latest version of Ivanti’s ICT, and apply the available patches.
“Based upon the authoring organizations’ observations during incident response activities and available industry reporting, as supplemented by CISA’s research findings, the authoring organizations recommend that the safest course of action for network defenders is to assume a sophisticated threat actor may deploy rootkit level persistence on a device that has been reset and lay dormant for an arbitrary amount of time,” the joint advisory reads.
The Five Eyes agencies also provide a list of indicators of compromise (IoCs) associated with Ivanti VPN exploitation, a set of Yara rules to help detection, and recommendations on incident response and mitigations.
The Five Eyes joint advisory contains information provided by Ivanti and Mandiant. Ivanti explained that the technique CISA used in its lab research has not been observed in attacks, and that applying the same conditions in the wild would break the connection to the appliance, preventing attackers from gaining persistence.
“We welcome findings from our security and government partners that enable our customers to protect themselves in the face of this evolving and highly sophisticated threat. To be clear, 29 February advisory does not contain information on a new vulnerability, and Ivanti and our partners are not aware of any instances of successful threat actor persistence following implementation of the security updates and factory resets recommended by Ivanti,” an Ivanti spokesperson said in an emailed comment.
On February 27, Ivanti announced the release of an enhanced ICT that can detect new files or changed files on affected appliances, based on known threat activity. The company also released updated recommendations based on the findings of its investigation into the observed attacks, conducted in collaboration with Mandiant.
The enhanced ICT “provides additional visibility into a customer’s appliance and all files that are present on the system. The enhanced external ICT will no longer require support to decrypt a customer’s snapshots. When new and/or modified files are found, the external ICT will now provide customers with an unencrypted snapshot for their own review,” Ivanti says.
However, the ICT is only meant to complement other tools, Ivanti explains. It cannot identify malicious activity if the appliance has been reset and other tools should be used to monitor changes made between scans and to find malware and other IoCs.
On February 8 and February 14, Ivanti announced new sets of patches for the affected products, which replace the fixes released on January 31. The patches were released for Connect Secure versions 9.1R14.5, 9.1R15.3, 9.1R16.3, 9.1R17.3, 9.1R18.4, 22.1R6.3, 22.2R4.1, 22.3R1, 22.4R1.1, 22.4R2.3, 22.5R1.2, 22.5R2.3 and 22.6R2.2, Policy Secure versions 9.1R16,3, 9.1R17.3, 9.1R18.4, 22.4R1.1, 22.5R1.2 and 22.6R1.1, and ZTA gateways versions 22.5R1.6, 22.6R1.5 and 22.6R1.7.
“Ivanti, Mandiant, CISA and the other JCSA authoring organizations continue to recommend that defenders apply available patching guidance provided by Ivanti if they haven’t done so already, and run Ivanti’s updated Integrity Checker Tool (ICT), released on 27 February, to help detect known attack vectors, alongside continuous monitoring,” the Ivanti spokesperson said.
Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks
Related: Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor
Related: CISA Sets 48-Hour Deadline for Removal of Insecure Ivanti Products
