Image: securityaffairs.com · rights & removal

Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero

Reporting by Security Affairs (Pierluigi Paganini)Read the original at securityaffairs.com

Executive Summary

An unknown threat actor, tracked as UTA0576, exploited a chain of three zero-day vulnerabilities in an Ivanti Connect Secure (ICS) VPN appliance running version 22.8R2.4 to gain unauthenticated root access. The exploit chain involved an authentication bypass, remote code execution (RCE), and privilege escalation. The initial vulnerability allowed authentication bypass by leveraging a mismatch between URL checking and HTTP headers on the public login page. This was followed by a race-condition flaw that enabled remote code execution, which allowed the attacker to upload a script disguised as a ZIP file. A subsequent step exploited a privileged background service to escalate privileges to root, allowing for in-memory code modification while restoring configuration data, which evaded detection by the Integrity Checker Tool. Post-exploitation involved reconnaissance, credential theft via an LDAP tool targeting local administrator passwords and recovery keys, harvesting cleartext credentials from LDAP traffic, building a Kerberos implementation for Kerberoasting, and executing password-spraying campaigns against Active Directory. The attacker also covered tracks by modifying logs, deleting files, and hiding packet capture tools within the system.

Facts Only

* Investigation began on October 5 with suspicious activity at a monitoring customer.
* The target was an Ivanti Connect Secure (ICS) VPN appliance running version 22.8R2.4.
* Three chained zero-days allowed the attacker to gain unauthenticated root access.
* Vulnerabilities tracked include an authentication bypass and remote code execution, both under CVE-2026-104935.
* The first flaw affected welcome.cgi, allowing authentication bypass via header manipulation.
* A race-condition flaw enabled remote code execution through the upload of a file.
* A privileged background service was exploited to escalate privileges to root.
* In-memory changes were made but configuration data was restored, bypassing detection by the Integrity Checker Tool.
* The attacker performed reconnaissance, stole credentials via an LDAP tool targeting Active Directory secrets, and harvested cleartext credentials from LDAP traffic.
* The investigation concluded with medium confidence that the actor used large language models (LLMs) for exploits and post-exploitation activities.

Full Take

The narrative demonstrates a pattern where sophisticated, multi-stage exploitation targets specific software flaws to achieve deep system control, followed by systematic credential harvesting indicative of criminal intent rather than simple espionage. The evasion technique—modifying in-memory state while restoring disk configurations—highlights a systemic gap in detection mechanisms that rely solely on file integrity checks. This forces an examination of what constitutes 'system state' and whether transient, volatile memory modifications can be effectively monitored across complex software stacks. The shift from exploiting a network device to actively targeting domain secrets (LAPS passwords, Kerberos) suggests an operational focus aimed at achieving persistence for lateral movement within a corporate environment, strongly aligning with criminal objectives. Furthermore, the mention of LLMs in post-exploitation activities introduces a new layer of complexity concerning attribution and the rate of sophistication; this suggests that the adversary is leveraging generalized knowledge to accelerate tactical execution, which challenges traditional threat modeling based on known exploit chains. The uncertainty regarding the ultimate motive indicates an awareness or deliberate obfuscation strategy intended to maximize operational flexibility, suggesting that external pressure (criminal motivation) dictates action more than ideological goals.
*Patterns detected: ARC-0024 Ambiguity, ARC-0043 Motte-and-Bailey, ARC-0057 Pattern Recognition*

From the original · Security Affairs (Pierluigi Paganini)

On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time.

Read the full story at securityaffairs.com

Sentinel — Human

Confidence

The text reads like a detailed security incident report synthesized from forensic work, characterized by deep technical specificity and measured attribution confidence, suggesting a human origin for the core analysis.

Signals Detected

Moderate sentence length variance and complex narrative flow; appears less uniformly rhythmic than typical LLM output.

Strong, consistent forensic focus; the narrative follows a clear investigative path, suggesting domain expertise in structuring technical findings.

Specific tracking of CVEs (CVE-2026-104935) and detailed step-by-step explanation of exploit chaining suggests specialized knowledge rather than general synthesis.

Specific, highly technical details (e.g., file path logic, internal service names like dsinvoked) are present, but the attribution of LLM use is hedged ('Volexity believes with medium confidence'), which mitigates high-risk fabrication.

Human Indicators

Use of specific, complex technical nomenclature (e.g., CVE numbers, specific file operations, LDAP commands) and the explicit focus on forensic process over simple summary.

The balancing act between presenting highly specific technical findings and hedging the attribution of motivation strongly indicates a human analyst framing investigative results.