Urgent Action Required: Multiple Threat Actors Exploit Zero-Day Flaws in Ivanti Connect Secure and Policy Secure Products

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, urging Federal Civilian Executive Branch (FCEB) agencies to take immediate action against two actively exploited zero-day flaws in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS) products. These vulnerabilities, an authentication bypass (CVE-2023-46805) and a code injection bug (CVE-2024-21887), have become the target of widespread exploitation by multiple threat actors.

Description of the vulnerabilities

The authentication bypass flaw allows malicious actors to circumvent the security measures in the affected products, granting them unauthorized access. On the other hand, the code injection bug enables attackers to craft malicious requests and execute arbitrary commands on the system. This combination of flaws poses a significant threat to the security and integrity of the affected systems.

Increase in threat actor activity

After the vulnerabilities were publicly disclosed, Ivanti noticed a sharp increase in threat actor activity, with attacks intensifying from January 11, 2024. This development highlights the significance and severity of the flaws, and the urgent need for organizations to address them promptly.

Potential impact and consequences

Successful exploitation of these vulnerabilities can have severe consequences. Attackers can move laterally within the system, infiltrate data, and establish persistent access. This ultimately leads to the full compromise of target information systems, putting sensitive data, infrastructure, and even national security at risk.

Mitigations urged by CISA

CISA’s emergency directive emphasizes the need for organizations running ICS to implement the recommended mitigations immediately. Additionally, organizations are advised to use the External Integrity Checker Tool to detect any signs of compromise. If compromise is detected, disconnecting the affected devices from networks, resetting them, and importing the provided XML file are crucial steps to minimize the damage.

Additional security measures

To further enhance security, FCEB entities are urged to revoke and reissue any stored certificates. Resetting the admin enable password and securely storing API keys are essential steps in preventing further unauthorized access. It is also recommended to reset the passwords of any locally defined users on the gateway, ensuring thorough cleaning and securing of the affected systems.

Observations by cybersecurity firms

Cybersecurity firms, including Volexity and Mandiant, have reported attacks that exploit these vulnerabilities. Threat actors have leveraged the flaws to deploy web shells and passive backdoors, enabling persistent access to compromised devices. Shockingly, it is estimated that approximately 2,100 devices worldwide have already fallen victim to these attacks, underscoring the urgent need for action.

Opportunistic Exploitation for Financial Gain

Notably, GreyNoise, a threat intelligence firm, has observed bad actors exploiting these vulnerabilities for financial gain. In addition to deploying backdoors, attackers have used the flaws to drop malicious XMRig cryptocurrency miners. This opportunistic exploitation demonstrates the need for vigilance and proactive measures to safeguard against monetary incentives that drive further attacks.

The urgency to address and mitigate the zero-day flaws in Ivanti Connect Secure and Policy Secure products cannot be overstated. Organizations must act swiftly to implement the recommended mitigations and security measures to protect their systems from compromise. The collaboration between CISA, Ivanti, and cybersecurity firms highlights the seriousness of these vulnerabilities and the collective effort required to defend against them. Proactive measures and constant monitoring are indispensable in the current threat landscape, ensuring that organizations stay one step ahead of malicious actors seeking to exploit vulnerabilities for their gain.

Explore more

Salesforce Buys Informatica for $8B to Boost Data and AI Strategy

The tech industry frequently witnesses seismic shifts, but few moves carry as much transformative potential as Salesforce’s recent acquisition of Informatica for $8 billion. As companies compete for technological dominance, this strategic purchase underscores Salesforce’s commitment to advancing its data and artificial intelligence strategy. This deal not only highlights Salesforce’s ambition to enhance its data management capabilities but also marks

Which iOS Email Apps Will Transform Marketing in 2025?

The landscape of email marketing is witnessing a profound transformation as businesses globally adapt to the shifting dynamics of digital communication. With iOS devices becoming increasingly integral to daily operations, email marketing apps specifically designed for these platforms have emerged as pivotal tools for enhancing marketing strategies. This shift has prompted companies to explore sophisticated email marketing solutions tailored for

Is Email Marketing the Future of Digital Strategy in 2025?

In a digital age where consumer attention is a scarce commodity, and marketers are continually seeking effective ways to connect with their audience, email marketing stands tall as a crucial component of digital strategies in 2025. With its immense potential for direct engagement and high return on investment, email marketing has sustained its relevance even amid the rise of new

Will AI Investments Transform Financial Institutions?

In recent years, financial institutions have increasingly invested in artificial intelligence (AI) to remain competitive and manage evolving customer expectations, with investments in AI technologies expected to constitute 16% of total tech expenditures. This investment trend is largely driven by the potential for AI to optimize operations and deliver deeper customer insights. Major banks like Bank of America have set

Transform Business Efficiency with Robotic Process Automation

In a world where 60% of jobs are predicted to have at least 30% of their tasks automated, Robotic Process Automation (RPA) stands at the forefront of transforming business efficiency. As companies strive to improve productivity and reduce operational costs, RPA has emerged as a pivotal technology. Driven by software bots, it replicates human actions to complete repetitive, rule-based tasks,