Security researchers have detailed an attack chain combining three vulnerabilities in Ivanti Connect Secure VPN appliances, allowing unauthenticated root command execution.
The incident highlights memory-resident evasion techniques and credential theft.
Ivanti has released patches for two components, with a fix pending for the third.
The incident was detected by security firm Volexity, which observed the attack on a customer using a fully updated version of the system. The operation began on October 3, and Ivanti confirmed that there are limited attacks underway.
The first two issues allow bypassing controls and executing commands remotely, while the third issue allows attackers to reach the highest levels of system access. Ivanti noted that versions prior to 25.1.3.0 are affected, while older versions 22.7R2.14 or earlier, as well as newer versions 22.8R2.5, 25.1.3.0, and 25.1.3.1 are not affected.
How did the perpetrators manage to hide?
The company is preparing a fix for the third issue that will be released in a future update. According to the researchers, built-in auditing tools do not detect the breach because the attackers did not leave behind any permanent files and only changed code in the system's memory.
During the incident, the perpetrators stole stored login credentials, searched for passwords in the network management system, and attempted to guess account passwords. Investigators assess with low certainty that the perpetrators' motives are criminal rather than espionage.
Top comments (0)